Overview

overview

7

Static

static

3

2026-10-26...op.exe

windows10-2004-x64

7

2026-10-26...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 07:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_c64d270d57fba0be5916c64a62ef0824_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261027-h1z8dsbs7t
  • SHA256 80b812e866c0d94f315f7ce8ea99300e3d7da6a7d306103d366068179bab6c1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_c64d270d57fba0be5916c64a62ef0824_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_c64d270d57fba0be5916c64a62ef0824_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2240
    • C:\Users\Admin\AppData\Local\Temp\psqdti.exe
      "C:\Users\Admin\AppData\Local\Temp\psqdti.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Users\Admin\AppData\Local\Temp\psqdti.exe
        "C:\Users\Admin\AppData\Local\Temp\psqdti.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Users\Admin\AppData\Roaming\Download\920881.exe
          "C:\Users\Admin\AppData\Roaming\Download\920881.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\Users\Admin\AppData\Roaming\Download\920881.exe
            "C:\Users\Admin\AppData\Roaming\Download\920881.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4380
        • C:\Users\Admin\AppData\Roaming\Download\383038.exe
          "C:\Users\Admin\AppData\Roaming\Download\383038.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Users\Admin\AppData\Roaming\Download\383038.exe
            "C:\Users\Admin\AppData\Roaming\Download\383038.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2748
        • C:\Users\Admin\AppData\Roaming\Download\397193.exe
          "C:\Users\Admin\AppData\Roaming\Download\397193.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Users\Admin\AppData\Roaming\Download\397193.exe
            "C:\Users\Admin\AppData\Roaming\Download\397193.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5196
        • C:\Users\Admin\AppData\Roaming\Download\519469.exe
          "C:\Users\Admin\AppData\Roaming\Download\519469.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Users\Admin\AppData\Roaming\Download\519469.exe
            "C:\Users\Admin\AppData\Roaming\Download\519469.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4740
        • C:\Users\Admin\AppData\Roaming\Download\765442.exe
          "C:\Users\Admin\AppData\Roaming\Download\765442.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5668
          • C:\Users\Admin\AppData\Roaming\Download\765442.exe
            "C:\Users\Admin\AppData\Roaming\Download\765442.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5820
        • C:\Users\Admin\AppData\Roaming\Download\952230.exe
          "C:\Users\Admin\AppData\Roaming\Download\952230.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2676
          • C:\Users\Admin\AppData\Roaming\Download\952230.exe
            "C:\Users\Admin\AppData\Roaming\Download\952230.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5132
        • C:\Users\Admin\AppData\Roaming\Download\275595.exe
          "C:\Users\Admin\AppData\Roaming\Download\275595.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5496
          • C:\Users\Admin\AppData\Roaming\Download\275595.exe
            "C:\Users\Admin\AppData\Roaming\Download\275595.exe"
            5⤵
            • Executes dropped EXE
            PID:5472
        • C:\Users\Admin\AppData\Roaming\Download\320578.exe
          "C:\Users\Admin\AppData\Roaming\Download\320578.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5716
          • C:\Users\Admin\AppData\Roaming\Download\320578.exe
            "C:\Users\Admin\AppData\Roaming\Download\320578.exe"
            5⤵
            • Executes dropped EXE
            PID:5772
        • C:\Users\Admin\AppData\Roaming\Download\212929.exe
          "C:\Users\Admin\AppData\Roaming\Download\212929.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4136
          • C:\Users\Admin\AppData\Roaming\Download\212929.exe
            "C:\Users\Admin\AppData\Roaming\Download\212929.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5912
        • C:\Users\Admin\AppData\Roaming\Download\456085.exe
          "C:\Users\Admin\AppData\Roaming\Download\456085.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2792
          • C:\Users\Admin\AppData\Roaming\Download\456085.exe
            "C:\Users\Admin\AppData\Roaming\Download\456085.exe"
            5⤵
            • Executes dropped EXE
            PID:3176
        • C:\Users\Admin\AppData\Roaming\Download\578351.exe
          "C:\Users\Admin\AppData\Roaming\Download\578351.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5808
          • C:\Users\Admin\AppData\Roaming\Download\578351.exe
            "C:\Users\Admin\AppData\Roaming\Download\578351.exe"
            5⤵
            • Executes dropped EXE
            PID:5832
        • C:\Users\Admin\AppData\Roaming\Download\591619.exe
          "C:\Users\Admin\AppData\Roaming\Download\591619.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3508
          • C:\Users\Admin\AppData\Roaming\Download\591619.exe
            "C:\Users\Admin\AppData\Roaming\Download\591619.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3236
        • C:\Users\Admin\AppData\Roaming\Download\599043.exe
          "C:\Users\Admin\AppData\Roaming\Download\599043.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5100
          • C:\Users\Admin\AppData\Roaming\Download\599043.exe
            "C:\Users\Admin\AppData\Roaming\Download\599043.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4888
        • C:\Users\Admin\AppData\Roaming\Download\511309.exe
          "C:\Users\Admin\AppData\Roaming\Download\511309.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5548
          • C:\Users\Admin\AppData\Roaming\Download\511309.exe
            "C:\Users\Admin\AppData\Roaming\Download\511309.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5608
        • C:\Users\Admin\AppData\Roaming\Download\563665.exe
          "C:\Users\Admin\AppData\Roaming\Download\563665.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:660
          • C:\Users\Admin\AppData\Roaming\Download\563665.exe
            "C:\Users\Admin\AppData\Roaming\Download\563665.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6060
        • C:\Users\Admin\AppData\Roaming\Download\688751.exe
          "C:\Users\Admin\AppData\Roaming\Download\688751.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5784
          • C:\Users\Admin\AppData\Roaming\Download\688751.exe
            "C:\Users\Admin\AppData\Roaming\Download\688751.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5672
        • C:\Users\Admin\AppData\Roaming\Download\666385.exe
          "C:\Users\Admin\AppData\Roaming\Download\666385.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5932
          • C:\Users\Admin\AppData\Roaming\Download\666385.exe
            "C:\Users\Admin\AppData\Roaming\Download\666385.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3184
        • C:\Users\Admin\AppData\Roaming\Download\608643.exe
          "C:\Users\Admin\AppData\Roaming\Download\608643.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5864
          • C:\Users\Admin\AppData\Roaming\Download\608643.exe
            "C:\Users\Admin\AppData\Roaming\Download\608643.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:388
        • C:\Users\Admin\AppData\Roaming\Download\589892.exe
          "C:\Users\Admin\AppData\Roaming\Download\589892.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5208
          • C:\Users\Admin\AppData\Roaming\Download\589892.exe
            "C:\Users\Admin\AppData\Roaming\Download\589892.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1948
        • C:\Users\Admin\AppData\Roaming\Download\221321.exe
          "C:\Users\Admin\AppData\Roaming\Download\221321.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4260
          • C:\Users\Admin\AppData\Roaming\Download\221321.exe
            "C:\Users\Admin\AppData\Roaming\Download\221321.exe"
            5⤵
            • Executes dropped EXE
            PID:3480
        • C:\Users\Admin\AppData\Roaming\Download\099957.exe
          "C:\Users\Admin\AppData\Roaming\Download\099957.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5528
          • C:\Users\Admin\AppData\Roaming\Download\099957.exe
            "C:\Users\Admin\AppData\Roaming\Download\099957.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2260
        • C:\Users\Admin\AppData\Roaming\Download\902498.exe
          "C:\Users\Admin\AppData\Roaming\Download\902498.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1644
          • C:\Users\Admin\AppData\Roaming\Download\902498.exe
            "C:\Users\Admin\AppData\Roaming\Download\902498.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3160
        • C:\Users\Admin\AppData\Roaming\Download\124564.exe
          "C:\Users\Admin\AppData\Roaming\Download\124564.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5796
          • C:\Users\Admin\AppData\Roaming\Download\124564.exe
            "C:\Users\Admin\AppData\Roaming\Download\124564.exe"
            5⤵
            • Executes dropped EXE
            PID:5824
        • C:\Users\Admin\AppData\Roaming\Download\411552.exe
          "C:\Users\Admin\AppData\Roaming\Download\411552.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5912
          • C:\Users\Admin\AppData\Roaming\Download\411552.exe
            "C:\Users\Admin\AppData\Roaming\Download\411552.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1156
        • C:\Users\Admin\AppData\Roaming\Download\406627.exe
          "C:\Users\Admin\AppData\Roaming\Download\406627.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1128
          • C:\Users\Admin\AppData\Roaming\Download\406627.exe
            "C:\Users\Admin\AppData\Roaming\Download\406627.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4636
        • C:\Users\Admin\AppData\Roaming\Download\448785.exe
          "C:\Users\Admin\AppData\Roaming\Download\448785.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2932
          • C:\Users\Admin\AppData\Roaming\Download\448785.exe
            "C:\Users\Admin\AppData\Roaming\Download\448785.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1292
        • C:\Users\Admin\AppData\Roaming\Download\935783.exe
          "C:\Users\Admin\AppData\Roaming\Download\935783.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5476
          • C:\Users\Admin\AppData\Roaming\Download\935783.exe
            "C:\Users\Admin\AppData\Roaming\Download\935783.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1796
        • C:\Users\Admin\AppData\Roaming\Download\703317.exe
          "C:\Users\Admin\AppData\Roaming\Download\703317.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2324
          • C:\Users\Admin\AppData\Roaming\Download\703317.exe
            "C:\Users\Admin\AppData\Roaming\Download\703317.exe"
            5⤵
            • Executes dropped EXE
            PID:6064
        • C:\Users\Admin\AppData\Roaming\Download\737473.exe
          "C:\Users\Admin\AppData\Roaming\Download\737473.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5776
          • C:\Users\Admin\AppData\Roaming\Download\737473.exe
            "C:\Users\Admin\AppData\Roaming\Download\737473.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5728
        • C:\Users\Admin\AppData\Roaming\Download\083655.exe
          "C:\Users\Admin\AppData\Roaming\Download\083655.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5940
          • C:\Users\Admin\AppData\Roaming\Download\083655.exe
            "C:\Users\Admin\AppData\Roaming\Download\083655.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3780
        • C:\Users\Admin\AppData\Roaming\Download\368443.exe
          "C:\Users\Admin\AppData\Roaming\Download\368443.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5860
          • C:\Users\Admin\AppData\Roaming\Download\368443.exe
            "C:\Users\Admin\AppData\Roaming\Download\368443.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5848
        • C:\Users\Admin\AppData\Roaming\Download\148077.exe
          "C:\Users\Admin\AppData\Roaming\Download\148077.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2168
          • C:\Users\Admin\AppData\Roaming\Download\148077.exe
            "C:\Users\Admin\AppData\Roaming\Download\148077.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5964
        • C:\Users\Admin\AppData\Roaming\Download\361143.exe
          "C:\Users\Admin\AppData\Roaming\Download\361143.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:1716
          • C:\Users\Admin\AppData\Roaming\Download\361143.exe
            "C:\Users\Admin\AppData\Roaming\Download\361143.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4104
        • C:\Users\Admin\AppData\Roaming\Download\893734.exe
          "C:\Users\Admin\AppData\Roaming\Download\893734.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2572
          • C:\Users\Admin\AppData\Roaming\Download\893734.exe
            "C:\Users\Admin\AppData\Roaming\Download\893734.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3772
        • C:\Users\Admin\AppData\Roaming\Download\818090.exe
          "C:\Users\Admin\AppData\Roaming\Download\818090.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          PID:5540
          • C:\Users\Admin\AppData\Roaming\Download\818090.exe
            "C:\Users\Admin\AppData\Roaming\Download\818090.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5584
        • C:\Users\Admin\AppData\Roaming\Download\060156.exe
          "C:\Users\Admin\AppData\Roaming\Download\060156.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2640
          • C:\Users\Admin\AppData\Roaming\Download\060156.exe
            "C:\Users\Admin\AppData\Roaming\Download\060156.exe"
            5⤵
              PID:548
          • C:\Users\Admin\AppData\Roaming\Download\082422.exe
            "C:\Users\Admin\AppData\Roaming\Download\082422.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3512
            • C:\Users\Admin\AppData\Roaming\Download\082422.exe
              "C:\Users\Admin\AppData\Roaming\Download\082422.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5184
          • C:\Users\Admin\AppData\Roaming\Download\125780.exe
            "C:\Users\Admin\AppData\Roaming\Download\125780.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3780
            • C:\Users\Admin\AppData\Roaming\Download\125780.exe
              "C:\Users\Admin\AppData\Roaming\Download\125780.exe"
              5⤵
                PID:5924
            • C:\Users\Admin\AppData\Roaming\Download\206039.exe
              "C:\Users\Admin\AppData\Roaming\Download\206039.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:376
              • C:\Users\Admin\AppData\Roaming\Download\206039.exe
                "C:\Users\Admin\AppData\Roaming\Download\206039.exe"
                5⤵
                  PID:5144
              • C:\Users\Admin\AppData\Roaming\Download\493828.exe
                "C:\Users\Admin\AppData\Roaming\Download\493828.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:5964
                • C:\Users\Admin\AppData\Roaming\Download\493828.exe
                  "C:\Users\Admin\AppData\Roaming\Download\493828.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4104
              • C:\Users\Admin\AppData\Roaming\Download\526104.exe
                "C:\Users\Admin\AppData\Roaming\Download\526104.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:4512
                • C:\Users\Admin\AppData\Roaming\Download\526104.exe
                  "C:\Users\Admin\AppData\Roaming\Download\526104.exe"
                  5⤵
                    PID:5508
                • C:\Users\Admin\AppData\Roaming\Download\295648.exe
                  "C:\Users\Admin\AppData\Roaming\Download\295648.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5536
                  • C:\Users\Admin\AppData\Roaming\Download\295648.exe
                    "C:\Users\Admin\AppData\Roaming\Download\295648.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5644
                • C:\Users\Admin\AppData\Roaming\Download\293273.exe
                  "C:\Users\Admin\AppData\Roaming\Download\293273.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  PID:5652
                  • C:\Users\Admin\AppData\Roaming\Download\293273.exe
                    "C:\Users\Admin\AppData\Roaming\Download\293273.exe"
                    5⤵
                      PID:1368
                  • C:\Users\Admin\AppData\Roaming\Download\315338.exe
                    "C:\Users\Admin\AppData\Roaming\Download\315338.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:2504
                    • C:\Users\Admin\AppData\Roaming\Download\315338.exe
                      "C:\Users\Admin\AppData\Roaming\Download\315338.exe"
                      5⤵
                        PID:5640
                    • C:\Users\Admin\AppData\Roaming\Download\461511.exe
                      "C:\Users\Admin\AppData\Roaming\Download\461511.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4856
                      • C:\Users\Admin\AppData\Roaming\Download\461511.exe
                        "C:\Users\Admin\AppData\Roaming\Download\461511.exe"
                        5⤵
                          PID:2404
                      • C:\Users\Admin\AppData\Roaming\Download\684677.exe
                        "C:\Users\Admin\AppData\Roaming\Download\684677.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:5760
                        • C:\Users\Admin\AppData\Roaming\Download\684677.exe
                          "C:\Users\Admin\AppData\Roaming\Download\684677.exe"
                          5⤵
                            PID:5828
                        • C:\Users\Admin\AppData\Roaming\Download\831859.exe
                          "C:\Users\Admin\AppData\Roaming\Download\831859.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:1840
                          • C:\Users\Admin\AppData\Roaming\Download\831859.exe
                            "C:\Users\Admin\AppData\Roaming\Download\831859.exe"
                            5⤵
                              PID:2868
                          • C:\Users\Admin\AppData\Roaming\Download\230464.exe
                            "C:\Users\Admin\AppData\Roaming\Download\230464.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            PID:5820
                            • C:\Users\Admin\AppData\Roaming\Download\230464.exe
                              "C:\Users\Admin\AppData\Roaming\Download\230464.exe"
                              5⤵
                                PID:4896
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                          2⤵
                          • Drops file in Program Files directory
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:4012
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x360,0x7fffba30c188,0x7fffba30c194,0x7fffba30c1a0
                            3⤵
                              PID:4424
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15425640182621686466,7204948305478981871,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
                              3⤵
                              • System Time Discovery
                              PID:1612
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15549359030684148239,10665917091996076976,262144 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
                              3⤵
                                PID:4312
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,2695843559283421189,10400537231019856121,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
                                3⤵
                                  PID:4980
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17612124895237672149,376788371518437675,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
                                  3⤵
                                    PID:2016
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,8490864845776949154,16721988306305002555,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                    3⤵
                                      PID:1152
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,17630277946225953963,9301544264837431397,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
                                      3⤵
                                        PID:3832
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5810094988649587847,4616676019658394675,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
                                        3⤵
                                          PID:2936
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,15395070254244304065,9000623027588932701,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
                                          3⤵
                                            PID:4268
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,6740790225488522337,11030521231403051057,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                                            3⤵
                                              PID:3976
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5232,i,5720040123623710148,9809974870423282903,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
                                              3⤵
                                                PID:952
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,82251034480725633,7103954353431044069,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
                                                3⤵
                                                  PID:1428
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,6359210872179320068,10695841442830888944,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
                                                  3⤵
                                                    PID:1056
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10211390719166004413,6943855126907011436,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
                                                    3⤵
                                                      PID:1588
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10211390719166004413,6943855126907011436,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
                                                      3⤵
                                                        PID:3956
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1072987697702390918,4211628743394515860,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                                                        3⤵
                                                          PID:1152
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6904553109099572878,3698187673520132030,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
                                                          3⤵
                                                            PID:4724
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,17577528769210062625,6867262761748780123,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
                                                            3⤵
                                                              PID:3240
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,4524883253064536850,9029559202530408627,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
                                                              3⤵
                                                                PID:1156
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3812586829858858715,10602430906681610634,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
                                                                3⤵
                                                                  PID:5884
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10675447715993857737,16309072806780898862,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
                                                                  3⤵
                                                                  • Modifies registry class
                                                                  PID:5244
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,4109248013536101776,15402252795806063002,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
                                                                  3⤵
                                                                    PID:5252
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6624,i,3231659079958752446,16695335199322060231,2097152 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
                                                                    3⤵
                                                                      PID:5348
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,14363100060353672924,13495893513710889522,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
                                                                      3⤵
                                                                        PID:5180
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,5887523878994628181,7828858509746653250,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
                                                                        3⤵
                                                                          PID:5848
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17013302405044701525,6930015131604673542,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
                                                                          3⤵
                                                                            PID:5844
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2900,i,8247912535428774731,4444663078273068908,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:8
                                                                            3⤵
                                                                              PID:2020
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,5078458440783290099,14633237963357719659,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
                                                                              3⤵
                                                                                PID:2592
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,6011732404165745500,7561660547297760505,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
                                                                                3⤵
                                                                                  PID:1888
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15540125685390581731,9717517043763117350,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
                                                                                  3⤵
                                                                                    PID:2284
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,401408061249288737,17962971328737654323,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
                                                                                    3⤵
                                                                                      PID:432
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11406002305810695344,14005688886177185100,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
                                                                                      3⤵
                                                                                        PID:5992
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,11314654201559686832,17137477119326741791,262144 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
                                                                                        3⤵
                                                                                          PID:4172
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,7049450660726421281,15611762115066020842,524288 --field-trial-handle=2008,i,12084434738857146007,12638384859512787685,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
                                                                                          3⤵
                                                                                            PID:5176
                                                                                        • C:\Windows\explorer.exe
                                                                                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                          2⤵
                                                                                            PID:4608
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                          1⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3856
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:1156
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:1080

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                DouTuDaShi.exe
                                                                                                • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                • Size 1.1MB
                                                                                                • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_1467520241\LICENSE
                                                                                                • Size 1KB
                                                                                                • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                verified_contents.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_1467520241\_metadata\verified_contents.json
                                                                                                • Size 1KB
                                                                                                • SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                keys.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_1467520241\keys.json
                                                                                                • Size 3KB
                                                                                                • SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                nav_config.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_1768224475\nav_config.json
                                                                                                • Size 2KB
                                                                                                • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                llm_user_input_extractor_config.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_399466293\llm_user_input_extractor_config.json
                                                                                                • Size 4KB
                                                                                                • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                office_endpoints_list.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_399466293\office_endpoints_list.json
                                                                                                • Size 9KB
                                                                                                • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                smart_switch_list.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_399466293\smart_switch_list.json
                                                                                                • Size 2KB
                                                                                                • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                protocols.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4012_87327345\protocols.json
                                                                                                • Size 3KB
                                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                E2D993E9BDDFC2D49E19866F11A7E662_30ABABA59798DF382C6B3DA520A43FF4
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2D993E9BDDFC2D49E19866F11A7E662_30ABABA59798DF382C6B3DA520A43FF4
                                                                                                • Size 471B
                                                                                                • SHA256 c235296e0b1dc9b9956c3e98b794c551c378b4555343a56595db4ceca0cd979f
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                E2D993E9BDDFC2D49E19866F11A7E662_30ABABA59798DF382C6B3DA520A43FF4
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2D993E9BDDFC2D49E19866F11A7E662_30ABABA59798DF382C6B3DA520A43FF4
                                                                                                • Size 494B
                                                                                                • SHA256 38c32da5ba1ace9be0b7839ebaaf12a3e9cada3009d40ee96f3594b357061e08
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                4ba97618-280a-49db-ba58-d13870a0b41c.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ba97618-280a-49db-ba58-d13870a0b41c.tmp
                                                                                                • Size 18KB
                                                                                                • SHA256 c062c8e0eae04cb1dde1d1ad7aed21d293bc307edf8457e0f9aafcd1168b7c21
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                73d71bb6-de92-4554-96bf-10198e805745.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73d71bb6-de92-4554-96bf-10198e805745.tmp
                                                                                                • Size 28KB
                                                                                                • SHA256 6e56aa53c7a2ee81ec34e2d3949d1a81db135a8a79afc0800a971a2800ebe54a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                8cb10f5d-bf5a-4e74-8e76-eb8f78c1a514.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8cb10f5d-bf5a-4e74-8e76-eb8f78c1a514.tmp
                                                                                                • Size 18KB
                                                                                                • SHA256 ca31eeb3c2db6010d3b1acf80e5ebf90881ea2a4fa484913e80eb1e0019c0233
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                544a2442-a3e5-4d27-8dce-ddd5122ab68a.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\544a2442-a3e5-4d27-8dce-ddd5122ab68a.tmp
                                                                                                • Size 105KB
                                                                                                • SHA256 c232ec974e0782cd13a8942d319d172253ded086c99dd896db4bd09ec5006e8d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                                • Size 135B
                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                14a80020-957a-4467-b72b-e4fecff4f072.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14a80020-957a-4467-b72b-e4fecff4f072.tmp
                                                                                                • Size 6B
                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LOG.old
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                • Size 331B
                                                                                                • SHA256 4d017c4395a14a9f6e51326e9f3beccb0cae040a6261aae021c6ce020f519e3e
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                temp-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                • Size 4KB
                                                                                                • SHA256 38eb595eb2810bd3182c3b3f49effca2fa73dea9a6c5a0aa2f47f970d72e3f9f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 3KB
                                                                                                • SHA256 ed84b2a738cd142379d7b0cff64d6b825480ac7fb59fbd1abc260f7ba6e72a66
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                8c37e42b-75a3-4d97-ad93-4dbc501edcfe.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8c37e42b-75a3-4d97-ad93-4dbc501edcfe.tmp
                                                                                                • Size 2B
                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                dasherSettingSchema.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                • Size 854B
                                                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                17c058a8-6901-4b1a-9506-aaa245cf5e51.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17c058a8-6901-4b1a-9506-aaa245cf5e51.tmp
                                                                                                • Size 6KB
                                                                                                • SHA256 75cf5520afa71cc3ccb1c79f4208af1a6ebf2131beb15e32aa8cb3f9bdd1ad2e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                9d26c98a-f5ab-436e-a69a-bbafc096f694.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d26c98a-f5ab-436e-a69a-bbafc096f694.tmp
                                                                                                • Size 2B
                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                be8a5ae6-bd8a-4ec8-91c3-93f1ef4d3d70.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be8a5ae6-bd8a-4ec8-91c3-93f1ef4d3d70.tmp
                                                                                                • Size 111B
                                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 11KB
                                                                                                • SHA256 2d26fded776403f8f3ac2d2f114e93253c4cc6b6267638a79b2c8f30ca232ff0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sync_diagnostic.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                • Size 4KB
                                                                                                • SHA256 97c88df4d9336b940db47671ccd04e15035ecbcdc60ea2a9d9ad7b139dc43697
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ad53de42-c275-44e9-a767-432917789050.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad53de42-c275-44e9-a767-432917789050.tmp
                                                                                                • Size 11KB
                                                                                                • SHA256 7de6c6c559545d2b1ed2136f150d6488ab82d10c2b9021a45ee4b569c0f5529a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                c4051909-26fc-457c-a4dc-429a8386ebe1.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4051909-26fc-457c-a4dc-429a8386ebe1.tmp
                                                                                                • Size 70KB
                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cb17190b-43bc-4d49-a413-5ad16d031afc.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb17190b-43bc-4d49-a413-5ad16d031afc.tmp
                                                                                                • Size 32KB
                                                                                                • SHA256 3f670587596c3dcc0819a05ced31e7ff28d9f6e752a66cdfb8e8fd45055eeb51
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                e2fc98ec-4e9b-44a6-bfad-f3f559c5b6b8.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2fc98ec-4e9b-44a6-bfad-f3f559c5b6b8.tmp
                                                                                                • Size 11KB
                                                                                                • SHA256 d56b67f0aa90525635da432cd6096db7bc9461e99c77f8c697b141b09a60d11f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                6c0fd842-a3a6-4c1f-88a7-83a046f106de.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c0fd842-a3a6-4c1f-88a7-83a046f106de.tmp
                                                                                                • Size 22KB
                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OperationConfig
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                • Size 3KB
                                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                                • Size 165B
                                                                                                • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                • Size 43B
                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
                                                                                                • Size 80B
                                                                                                • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                                • Size 160B
                                                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                bc9103a3-c6f8-4e40-a894-3112f87e34a1.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bc9103a3-c6f8-4e40-a894-3112f87e34a1.tmp
                                                                                                • Size 8KB
                                                                                                • SHA256 1307790fd31f9552192e96ad4faafee136ffc0af8b0a501c11e3c30111d694e4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                43ee2771-50d5-4467-a099-5fdff5caeb7c.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\43ee2771-50d5-4467-a099-5fdff5caeb7c.tmp
                                                                                                • Size 252B
                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                5369c3d6-e39f-4ad0-bf15-eb4361e3733a.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5369c3d6-e39f-4ad0-bf15-eb4361e3733a.tmp
                                                                                                • Size 492B
                                                                                                • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                8d4010a2-c23c-41d1-9b47-d6d539436be6.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8d4010a2-c23c-41d1-9b47-d6d539436be6.tmp
                                                                                                • Size 132B
                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                99dbf29e-6eb8-4d5f-a9c3-68efed509ecd.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\99dbf29e-6eb8-4d5f-a9c3-68efed509ecd.tmp
                                                                                                • Size 372B
                                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                d1f8e90c-849d-4f52-b4bd-c6fbac5bae88.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1f8e90c-849d-4f52-b4bd-c6fbac5bae88.tmp
                                                                                                • Size 8KB
                                                                                                • SHA256 dc32b351cd9c4e77e5391abf900428de5e205752161042e3a28aa71cc53a7393
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                a1f7786e-407a-48f9-85cf-68538cfa1c68.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1f7786e-407a-48f9-85cf-68538cfa1c68.tmp
                                                                                                • Size 13B
                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UQFZZHED\hao.360[1].xml
                                                                                                • Size 52KB
                                                                                                • SHA256 ce04a2b510974ee96ab3053800646529205b76dbc310083e190c049705bdfb32
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UQFZZHED\hao.360[1].xml
                                                                                                • Size 852B
                                                                                                • SHA256 aed4f5e26e9b354889c05993208b94343a2f713f298491e17ae860a94fd070db
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UQFZZHED\hao.360[1].xml
                                                                                                • Size 2KB
                                                                                                • SHA256 059bce62122c246e6c5b45f669897e8e77bdd7f9141a67c748fe659b42412c8e
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Size 2KB
                                                                                                • SHA256 e947dd4dc360b03d0165edf1ece4a40ef58d48edf6bd2fb3b9fd9b7e70404a86
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                time[1].js
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LBHX3A6T\time[1].js
                                                                                                • Size 27B
                                                                                                • SHA256 6fc9676aaac7a6c480889a183f0f9bd45f6ec2d168965cec8c5ae1a5dba97498
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                113[1].js
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\113[1].js
                                                                                                • Size 61KB
                                                                                                • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                0[1].png
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\0[1].png
                                                                                                • Size 574B
                                                                                                • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                sed_api_weather_info[1].htm
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\sed_api_weather_info[1].htm
                                                                                                • Size 8KB
                                                                                                • SHA256 8d9fd85e2db733032649dcb7a8c36901cf6b8a2bc65359848393281df2540a46
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                023aef4f-3f24-4c2f-b235-9a47a2ee8ca3.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\023aef4f-3f24-4c2f-b235-9a47a2ee8ca3.tmp
                                                                                                • Size 1B
                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                843634d0-17a5-4d0e-9d04-73a9588a796b.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\843634d0-17a5-4d0e-9d04-73a9588a796b.tmp
                                                                                                • Size 158KB
                                                                                                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ldsajdklsajdlkjsalkda.bat
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                • Size 589B
                                                                                                • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                psqdti.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\psqdti.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 80b812e866c0d94f315f7ce8ea99300e3d7da6a7d306103d366068179bab6c1d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                verified_contents.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4012_1274031993\CRX_INSTALL\_metadata\verified_contents.json
                                                                                                • Size 1KB
                                                                                                • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                content.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4012_1274031993\CRX_INSTALL\content.js
                                                                                                • Size 9KB
                                                                                                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4012_1274031993\CRX_INSTALL\manifest.json
                                                                                                • Size 962B
                                                                                                • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                f020bad9-4aa6-4a6b-8f49-e5ff35eed32f.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4012_1274031993\f020bad9-4aa6-4a6b-8f49-e5ff35eed32f.tmp
                                                                                                • Size 10KB
                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                messages.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4012_174449171\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                • Size 711B
                                                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                212929.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\212929.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 be28fae2f45a2ac5d787c8805623df807e262832bc1204130e04e13239845691
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                275595.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\275595.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 2be5dd5ede8e831b51bec43794fa554a2930c3b53fde9d561808e03056b42f43
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                320578.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\320578.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 92a192c7671305b99984e56005550635c0b30f92e4aeeee188e4b06dabe09744
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                383038.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\383038.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 a388c6f5f4ddb44598984bdb986763a3d055554ebce7e99f523f3e2bd240d3b7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                397193.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\397193.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 144ef1ee270a288c2dbd2ec1fa2bbeda4738c2095e31fb021f857aaaa7c997f7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                456085.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\456085.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 99610ecccf2bf8530b74496e0fcdae8f4e03ba7673a4d8883361b552dae67a98
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                519469.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\519469.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 2f0e8d1e4e61d3662342b2ea3a1e23a29795f3cc484b7813d8f4d7c652bb9023
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                578351.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\578351.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 7e9f0fee3069ccda57f318f91bc1a67801412b882f9b9d034cabb024251adaff
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                591619.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\591619.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 559e73c1f3b19cbf19f5b541a3829fde7d269bef2823d5a57bd6d120feee72c6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                765442.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\765442.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 e6e1859d5447d1d827fbfe441ae434aabb9417a75f5b55305c887d04178004b8
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                920881.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\920881.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 d5a4b39e4b3dea2f8def5d25858590d03ae566157b1fe3d7462491cf30b7f6af
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                952230.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\952230.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 9ce3dc1b841c054e7ddfba697bf35f33762ff76a5a6517346b454b0cbbd1f9de
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/1476-185-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1479-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1364-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1644-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-567-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1695-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1426-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1525-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/3264-1587-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/4804-24-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download