Overview

overview

7

Static

static

3

2026-10-26...op.exe

windows10-2004-x64

7

2026-10-26...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 06:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261027-hqr42abs21
  • SHA256 9b03cfc4987e343af2d6ae6d63c3f151c03ba74067a58a643c3f636a3d915129
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 51 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 14 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:1388
    • C:\Users\Admin\AppData\Local\Temp\hhmkln.exe
      "C:\Users\Admin\AppData\Local\Temp\hhmkln.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Users\Admin\AppData\Local\Temp\hhmkln.exe
        "C:\Users\Admin\AppData\Local\Temp\hhmkln.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Users\Admin\AppData\Roaming\Download\383421.exe
          "C:\Users\Admin\AppData\Roaming\Download\383421.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Users\Admin\AppData\Roaming\Download\383421.exe
            "C:\Users\Admin\AppData\Roaming\Download\383421.exe"
            5⤵
            • Executes dropped EXE
            PID:1688
        • C:\Users\Admin\AppData\Roaming\Download\946135.exe
          "C:\Users\Admin\AppData\Roaming\Download\946135.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Users\Admin\AppData\Roaming\Download\946135.exe
            "C:\Users\Admin\AppData\Roaming\Download\946135.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4684
        • C:\Users\Admin\AppData\Roaming\Download\796202.exe
          "C:\Users\Admin\AppData\Roaming\Download\796202.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Users\Admin\AppData\Roaming\Download\796202.exe
            "C:\Users\Admin\AppData\Roaming\Download\796202.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5216
        • C:\Users\Admin\AppData\Roaming\Download\083099.exe
          "C:\Users\Admin\AppData\Roaming\Download\083099.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5440
          • C:\Users\Admin\AppData\Roaming\Download\083099.exe
            "C:\Users\Admin\AppData\Roaming\Download\083099.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6104
        • C:\Users\Admin\AppData\Roaming\Download\205375.exe
          "C:\Users\Admin\AppData\Roaming\Download\205375.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5656
          • C:\Users\Admin\AppData\Roaming\Download\205375.exe
            "C:\Users\Admin\AppData\Roaming\Download\205375.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5348
        • C:\Users\Admin\AppData\Roaming\Download\964974.exe
          "C:\Users\Admin\AppData\Roaming\Download\964974.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5500
          • C:\Users\Admin\AppData\Roaming\Download\964974.exe
            "C:\Users\Admin\AppData\Roaming\Download\964974.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5504
        • C:\Users\Admin\AppData\Roaming\Download\996230.exe
          "C:\Users\Admin\AppData\Roaming\Download\996230.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5320
          • C:\Users\Admin\AppData\Roaming\Download\996230.exe
            "C:\Users\Admin\AppData\Roaming\Download\996230.exe"
            5⤵
            • Executes dropped EXE
            PID:5752
        • C:\Users\Admin\AppData\Roaming\Download\273050.exe
          "C:\Users\Admin\AppData\Roaming\Download\273050.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5884
          • C:\Users\Admin\AppData\Roaming\Download\273050.exe
            "C:\Users\Admin\AppData\Roaming\Download\273050.exe"
            5⤵
            • Executes dropped EXE
            PID:1168
        • C:\Users\Admin\AppData\Roaming\Download\774762.exe
          "C:\Users\Admin\AppData\Roaming\Download\774762.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5288
          • C:\Users\Admin\AppData\Roaming\Download\774762.exe
            "C:\Users\Admin\AppData\Roaming\Download\774762.exe"
            5⤵
            • Executes dropped EXE
            PID:5644
        • C:\Users\Admin\AppData\Roaming\Download\755193.exe
          "C:\Users\Admin\AppData\Roaming\Download\755193.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5516
          • C:\Users\Admin\AppData\Roaming\Download\755193.exe
            "C:\Users\Admin\AppData\Roaming\Download\755193.exe"
            5⤵
            • Executes dropped EXE
            PID:5520
        • C:\Users\Admin\AppData\Roaming\Download\777479.exe
          "C:\Users\Admin\AppData\Roaming\Download\777479.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5560
          • C:\Users\Admin\AppData\Roaming\Download\777479.exe
            "C:\Users\Admin\AppData\Roaming\Download\777479.exe"
            5⤵
            • Executes dropped EXE
            PID:4800
        • C:\Users\Admin\AppData\Roaming\Download\880700.exe
          "C:\Users\Admin\AppData\Roaming\Download\880700.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1820
          • C:\Users\Admin\AppData\Roaming\Download\880700.exe
            "C:\Users\Admin\AppData\Roaming\Download\880700.exe"
            5⤵
            • Executes dropped EXE
            PID:4260
        • C:\Users\Admin\AppData\Roaming\Download\944893.exe
          "C:\Users\Admin\AppData\Roaming\Download\944893.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6020
          • C:\Users\Admin\AppData\Roaming\Download\944893.exe
            "C:\Users\Admin\AppData\Roaming\Download\944893.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6136
        • C:\Users\Admin\AppData\Roaming\Download\945144.exe
          "C:\Users\Admin\AppData\Roaming\Download\945144.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4480
          • C:\Users\Admin\AppData\Roaming\Download\945144.exe
            "C:\Users\Admin\AppData\Roaming\Download\945144.exe"
            5⤵
            • Executes dropped EXE
            PID:4528
        • C:\Users\Admin\AppData\Roaming\Download\312141.exe
          "C:\Users\Admin\AppData\Roaming\Download\312141.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5260
          • C:\Users\Admin\AppData\Roaming\Download\312141.exe
            "C:\Users\Admin\AppData\Roaming\Download\312141.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5352
        • C:\Users\Admin\AppData\Roaming\Download\213392.exe
          "C:\Users\Admin\AppData\Roaming\Download\213392.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5028
          • C:\Users\Admin\AppData\Roaming\Download\213392.exe
            "C:\Users\Admin\AppData\Roaming\Download\213392.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4188
        • C:\Users\Admin\AppData\Roaming\Download\246658.exe
          "C:\Users\Admin\AppData\Roaming\Download\246658.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5536
          • C:\Users\Admin\AppData\Roaming\Download\246658.exe
            "C:\Users\Admin\AppData\Roaming\Download\246658.exe"
            5⤵
            • Executes dropped EXE
            PID:5520
        • C:\Users\Admin\AppData\Roaming\Download\523446.exe
          "C:\Users\Admin\AppData\Roaming\Download\523446.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4252
          • C:\Users\Admin\AppData\Roaming\Download\523446.exe
            "C:\Users\Admin\AppData\Roaming\Download\523446.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:400
        • C:\Users\Admin\AppData\Roaming\Download\461265.exe
          "C:\Users\Admin\AppData\Roaming\Download\461265.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6120
          • C:\Users\Admin\AppData\Roaming\Download\461265.exe
            "C:\Users\Admin\AppData\Roaming\Download\461265.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2728
        • C:\Users\Admin\AppData\Roaming\Download\545346.exe
          "C:\Users\Admin\AppData\Roaming\Download\545346.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5984
          • C:\Users\Admin\AppData\Roaming\Download\545346.exe
            "C:\Users\Admin\AppData\Roaming\Download\545346.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5820
        • C:\Users\Admin\AppData\Roaming\Download\578402.exe
          "C:\Users\Admin\AppData\Roaming\Download\578402.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2504
          • C:\Users\Admin\AppData\Roaming\Download\578402.exe
            "C:\Users\Admin\AppData\Roaming\Download\578402.exe"
            5⤵
            • Executes dropped EXE
            PID:1380
        • C:\Users\Admin\AppData\Roaming\Download\779953.exe
          "C:\Users\Admin\AppData\Roaming\Download\779953.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2972
          • C:\Users\Admin\AppData\Roaming\Download\779953.exe
            "C:\Users\Admin\AppData\Roaming\Download\779953.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5236
        • C:\Users\Admin\AppData\Roaming\Download\791019.exe
          "C:\Users\Admin\AppData\Roaming\Download\791019.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3908
          • C:\Users\Admin\AppData\Roaming\Download\791019.exe
            "C:\Users\Admin\AppData\Roaming\Download\791019.exe"
            5⤵
            • Executes dropped EXE
            PID:4732
        • C:\Users\Admin\AppData\Roaming\Download\723375.exe
          "C:\Users\Admin\AppData\Roaming\Download\723375.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6132
          • C:\Users\Admin\AppData\Roaming\Download\723375.exe
            "C:\Users\Admin\AppData\Roaming\Download\723375.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4892
        • C:\Users\Admin\AppData\Roaming\Download\966432.exe
          "C:\Users\Admin\AppData\Roaming\Download\966432.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:728
          • C:\Users\Admin\AppData\Roaming\Download\966432.exe
            "C:\Users\Admin\AppData\Roaming\Download\966432.exe"
            5⤵
            • Executes dropped EXE
            PID:5592
        • C:\Users\Admin\AppData\Roaming\Download\072708.exe
          "C:\Users\Admin\AppData\Roaming\Download\072708.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5728
          • C:\Users\Admin\AppData\Roaming\Download\072708.exe
            "C:\Users\Admin\AppData\Roaming\Download\072708.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5732
        • C:\Users\Admin\AppData\Roaming\Download\247506.exe
          "C:\Users\Admin\AppData\Roaming\Download\247506.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5820
          • C:\Users\Admin\AppData\Roaming\Download\247506.exe
            "C:\Users\Admin\AppData\Roaming\Download\247506.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1512
        • C:\Users\Admin\AppData\Roaming\Download\482862.exe
          "C:\Users\Admin\AppData\Roaming\Download\482862.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1380
          • C:\Users\Admin\AppData\Roaming\Download\482862.exe
            "C:\Users\Admin\AppData\Roaming\Download\482862.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5428
        • C:\Users\Admin\AppData\Roaming\Download\504929.exe
          "C:\Users\Admin\AppData\Roaming\Download\504929.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5236
          • C:\Users\Admin\AppData\Roaming\Download\504929.exe
            "C:\Users\Admin\AppData\Roaming\Download\504929.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5356
        • C:\Users\Admin\AppData\Roaming\Download\405478.exe
          "C:\Users\Admin\AppData\Roaming\Download\405478.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2408
          • C:\Users\Admin\AppData\Roaming\Download\405478.exe
            "C:\Users\Admin\AppData\Roaming\Download\405478.exe"
            5⤵
            • Executes dropped EXE
            PID:4156
        • C:\Users\Admin\AppData\Roaming\Download\673268.exe
          "C:\Users\Admin\AppData\Roaming\Download\673268.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4608
          • C:\Users\Admin\AppData\Roaming\Download\673268.exe
            "C:\Users\Admin\AppData\Roaming\Download\673268.exe"
            5⤵
              PID:5348
          • C:\Users\Admin\AppData\Roaming\Download\815554.exe
            "C:\Users\Admin\AppData\Roaming\Download\815554.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:5544
            • C:\Users\Admin\AppData\Roaming\Download\815554.exe
              "C:\Users\Admin\AppData\Roaming\Download\815554.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1856
          • C:\Users\Admin\AppData\Roaming\Download\806775.exe
            "C:\Users\Admin\AppData\Roaming\Download\806775.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:876
            • C:\Users\Admin\AppData\Roaming\Download\806775.exe
              "C:\Users\Admin\AppData\Roaming\Download\806775.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1792
          • C:\Users\Admin\AppData\Roaming\Download\840061.exe
            "C:\Users\Admin\AppData\Roaming\Download\840061.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3092
            • C:\Users\Admin\AppData\Roaming\Download\840061.exe
              "C:\Users\Admin\AppData\Roaming\Download\840061.exe"
              5⤵
                PID:5340
            • C:\Users\Admin\AppData\Roaming\Download\921592.exe
              "C:\Users\Admin\AppData\Roaming\Download\921592.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:5832
              • C:\Users\Admin\AppData\Roaming\Download\921592.exe
                "C:\Users\Admin\AppData\Roaming\Download\921592.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5876
            • C:\Users\Admin\AppData\Roaming\Download\841751.exe
              "C:\Users\Admin\AppData\Roaming\Download\841751.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5064
              • C:\Users\Admin\AppData\Roaming\Download\841751.exe
                "C:\Users\Admin\AppData\Roaming\Download\841751.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3984
            • C:\Users\Admin\AppData\Roaming\Download\996933.exe
              "C:\Users\Admin\AppData\Roaming\Download\996933.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:3088
              • C:\Users\Admin\AppData\Roaming\Download\996933.exe
                "C:\Users\Admin\AppData\Roaming\Download\996933.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4920
            • C:\Users\Admin\AppData\Roaming\Download\219099.exe
              "C:\Users\Admin\AppData\Roaming\Download\219099.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:1804
              • C:\Users\Admin\AppData\Roaming\Download\219099.exe
                "C:\Users\Admin\AppData\Roaming\Download\219099.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5332
            • C:\Users\Admin\AppData\Roaming\Download\406097.exe
              "C:\Users\Admin\AppData\Roaming\Download\406097.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:3940
              • C:\Users\Admin\AppData\Roaming\Download\406097.exe
                "C:\Users\Admin\AppData\Roaming\Download\406097.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1460
            • C:\Users\Admin\AppData\Roaming\Download\144506.exe
              "C:\Users\Admin\AppData\Roaming\Download\144506.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:4932
              • C:\Users\Admin\AppData\Roaming\Download\144506.exe
                "C:\Users\Admin\AppData\Roaming\Download\144506.exe"
                5⤵
                  PID:5348
              • C:\Users\Admin\AppData\Roaming\Download\228787.exe
                "C:\Users\Admin\AppData\Roaming\Download\228787.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:3304
                • C:\Users\Admin\AppData\Roaming\Download\228787.exe
                  "C:\Users\Admin\AppData\Roaming\Download\228787.exe"
                  5⤵
                    PID:6044
                • C:\Users\Admin\AppData\Roaming\Download\206313.exe
                  "C:\Users\Admin\AppData\Roaming\Download\206313.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5316
                  • C:\Users\Admin\AppData\Roaming\Download\206313.exe
                    "C:\Users\Admin\AppData\Roaming\Download\206313.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3852
                • C:\Users\Admin\AppData\Roaming\Download\452296.exe
                  "C:\Users\Admin\AppData\Roaming\Download\452296.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5340
                  • C:\Users\Admin\AppData\Roaming\Download\452296.exe
                    "C:\Users\Admin\AppData\Roaming\Download\452296.exe"
                    5⤵
                      PID:5376
                  • C:\Users\Admin\AppData\Roaming\Download\474552.exe
                    "C:\Users\Admin\AppData\Roaming\Download\474552.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5724
                    • C:\Users\Admin\AppData\Roaming\Download\474552.exe
                      "C:\Users\Admin\AppData\Roaming\Download\474552.exe"
                      5⤵
                        PID:5784
                    • C:\Users\Admin\AppData\Roaming\Download\557803.exe
                      "C:\Users\Admin\AppData\Roaming\Download\557803.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:4124
                      • C:\Users\Admin\AppData\Roaming\Download\557803.exe
                        "C:\Users\Admin\AppData\Roaming\Download\557803.exe"
                        5⤵
                          PID:5056
                      • C:\Users\Admin\AppData\Roaming\Download\590179.exe
                        "C:\Users\Admin\AppData\Roaming\Download\590179.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        PID:5648
                        • C:\Users\Admin\AppData\Roaming\Download\590179.exe
                          "C:\Users\Admin\AppData\Roaming\Download\590179.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:2636
                      • C:\Users\Admin\AppData\Roaming\Download\887966.exe
                        "C:\Users\Admin\AppData\Roaming\Download\887966.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        • System Location Discovery: System Language Discovery
                        PID:3508
                        • C:\Users\Admin\AppData\Roaming\Download\887966.exe
                          "C:\Users\Admin\AppData\Roaming\Download\887966.exe"
                          5⤵
                            PID:5888
                        • C:\Users\Admin\AppData\Roaming\Download\009222.exe
                          "C:\Users\Admin\AppData\Roaming\Download\009222.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:4816
                          • C:\Users\Admin\AppData\Roaming\Download\009222.exe
                            "C:\Users\Admin\AppData\Roaming\Download\009222.exe"
                            5⤵
                              PID:3876
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                        2⤵
                        • Drops file in Program Files directory
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Modifies registry class
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:216
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2a8,0x2c8,0x2cc,0x2c4,0x2ec,0x7fff6f8fc188,0x7fff6f8fc194,0x7fff6f8fc1a0
                          3⤵
                            PID:3576
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,16558617071190996480,7187849491075899448,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
                            3⤵
                            • System Time Discovery
                            PID:1624
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,3467537934057445010,8908554048828627211,262144 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
                            3⤵
                              PID:3476
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,9443589094164551117,14508314279207118262,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
                              3⤵
                                PID:2664
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4675963974942152617,3297450005885759815,2097152 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                3⤵
                                  PID:4744
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6395783240667930213,3558018352984520044,2097152 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                  3⤵
                                    PID:4616
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7484659856189968501,7363777413072599198,2097152 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
                                    3⤵
                                      PID:2256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,11143082020764171163,9248517639984854509,2097152 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
                                      3⤵
                                        PID:4484
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15313012581614541856,7800410806025814475,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                                        3⤵
                                          PID:2408
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,12865987967007175902,11876441493535024619,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
                                          3⤵
                                            PID:4216
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,4263652615560961688,2179416164791110585,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                                            3⤵
                                              PID:3540
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,18432789603112890057,1912451683905594418,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                                              3⤵
                                                PID:3908
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16650917366604919341,6189720741358275422,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
                                                3⤵
                                                  PID:412
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16650917366604919341,6189720741358275422,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
                                                  3⤵
                                                    PID:2728
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6068,i,940599363558486873,13571597111104498489,2097152 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
                                                    3⤵
                                                      PID:5196
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13606965230700839044,2099345689155801708,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
                                                      3⤵
                                                        PID:5648
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,10751884664265358049,10822015154369223270,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
                                                        3⤵
                                                          PID:5872
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,12783667119057434317,12557519051902442040,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
                                                          3⤵
                                                            PID:6100
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16790622006510429805,13001303476826079956,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
                                                            3⤵
                                                              PID:6140
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9340608366271163519,17957891170983564492,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
                                                              3⤵
                                                                PID:5600
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,12664373560040317815,8546661023957361423,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
                                                                3⤵
                                                                  PID:5892
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,14653800752865168922,18046405079296195557,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
                                                                  3⤵
                                                                  • Modifies registry class
                                                                  PID:5896
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,6267844333163108782,2832244232377309275,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
                                                                  3⤵
                                                                    PID:6040
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15117366308467596488,10990958916201958590,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
                                                                    3⤵
                                                                      PID:6052
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,7949040751158601208,9397434912218579503,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
                                                                      3⤵
                                                                        PID:6056
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,11733294004585615120,2620416809525880810,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
                                                                        3⤵
                                                                          PID:5980
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,11629203537870469142,9261470875790064946,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
                                                                          3⤵
                                                                            PID:4200
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,15372866071829691245,3094146788554784834,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
                                                                            3⤵
                                                                              PID:5188
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,7710273516645521339,17027775631848758266,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
                                                                              3⤵
                                                                                PID:3992
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16572228231912945473,8455856595583773609,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
                                                                                3⤵
                                                                                  PID:5468
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3692,i,1193038351999558851,2703362492442825585,262144 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
                                                                                  3⤵
                                                                                    PID:4948
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,15361021753411751994,15606051794819623472,524288 --field-trial-handle=2364,i,3681636964608936225,6634134324335489440,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
                                                                                    3⤵
                                                                                      PID:5720
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    2⤵
                                                                                      PID:1724
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                    1⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2756
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2680
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:400
                                                                                    • C:\Windows\System32\sihclient.exe
                                                                                      C:\Windows\System32\sihclient.exe /cv NTYBzIoXBEeFFcTAsoDSRw.0.2
                                                                                      1⤵
                                                                                        PID:5348

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            DouTuDaShi.exe
                                                                                            • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                            • Size 1.1MB
                                                                                            • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            nav_config.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_1114719118\nav_config.json
                                                                                            • Size 2KB
                                                                                            • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            protocols.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_1574056578\protocols.json
                                                                                            • Size 3KB
                                                                                            • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            LICENSE
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_1719815476\LICENSE
                                                                                            • Size 1KB
                                                                                            • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            verified_contents.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_1719815476\_metadata\verified_contents.json
                                                                                            • Size 1KB
                                                                                            • SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            keys.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_1719815476\keys.json
                                                                                            • Size 3KB
                                                                                            • SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            llm_user_input_extractor_config.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_765284042\llm_user_input_extractor_config.json
                                                                                            • Size 4KB
                                                                                            • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            office_endpoints_list.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_765284042\office_endpoints_list.json
                                                                                            • Size 9KB
                                                                                            • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            smart_switch_list.json
                                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping216_765284042\smart_switch_list.json
                                                                                            • Size 2KB
                                                                                            • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            46ec827f-0a2f-4c6e-b7ce-0907cdbf12e4.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46ec827f-0a2f-4c6e-b7ce-0907cdbf12e4.tmp
                                                                                            • Size 18KB
                                                                                            • SHA256 7f0961a6a51c6bd02c14e7b61d9ec0c8ac0278484873b7072ad38238f18db8d4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            684a96b2-3c00-4629-a01e-2b40890abb7b.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\684a96b2-3c00-4629-a01e-2b40890abb7b.tmp
                                                                                            • Size 28KB
                                                                                            • SHA256 09ee49e7497245731b0aefd59720d2dec3d51b721752ff270244f96a874bbd97
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                            • Size 135B
                                                                                            • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            2714d837-4a18-48c7-894b-20700d0d1737.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2714d837-4a18-48c7-894b-20700d0d1737.tmp
                                                                                            • Size 11KB
                                                                                            • SHA256 ae46da4e543b81ebadb1990ce288bbdc462cbf00724c2a45271de0a369b22237
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            3f139544-4215-440f-a80d-5ed8972c5c05.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f139544-4215-440f-a80d-5ed8972c5c05.tmp
                                                                                            • Size 11KB
                                                                                            • SHA256 ca364908f17bd7ffd6e6c9ec72efa6b12ae58848cf81c492b489e3a271c4ac1c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            9d8410b3-5909-414a-8c3f-2c4a88c3f29c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d8410b3-5909-414a-8c3f-2c4a88c3f29c.tmp
                                                                                            • Size 32KB
                                                                                            • SHA256 5c49953abac0f4422b30b7ea8a66c20a4bdbf795e24bca18e02bbe9a65b3950b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            f_00006a
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
                                                                                            • Size 61KB
                                                                                            • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            temp-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                            • Size 4KB
                                                                                            • SHA256 7f3838f8d624ed88a5773b83befba75bb0454cd0552acdfecac0601d5d586522
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 4KB
                                                                                            • SHA256 f27a4552606df9cebf5103a8891c6b05a3cd1d72abb30b863ad8839608a5671e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 3KB
                                                                                            • SHA256 1a2d7c306a8e09cc2d5de5e193a0a30cd45b153df2cd39416694aca9054d3bb8
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            b43cd759-b995-4471-b6d3-156edfe64f7b.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b43cd759-b995-4471-b6d3-156edfe64f7b.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            dasherSettingSchema.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                            • Size 854B
                                                                                            • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            83caac00-c980-4996-91b8-a9e2e3fb17d9.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\83caac00-c980-4996-91b8-a9e2e3fb17d9.tmp
                                                                                            • Size 111B
                                                                                            • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            Network Persistent State
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                            • Size 4KB
                                                                                            • SHA256 8ca0ccb8c8d2151ffb12bd72940c19cfd50681a86be9e2e99d751108ca0e3d24
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ac5256b5-c7fc-4531-9a04-f75df5f773ab.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac5256b5-c7fc-4531-9a04-f75df5f773ab.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            e97f078c-9aca-478d-b5bf-ac96f8811aa7.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e97f078c-9aca-478d-b5bf-ac96f8811aa7.tmp
                                                                                            • Size 11KB
                                                                                            • SHA256 aabdea13d0346fdcc46ef9aae1da22435297e5282aa1562f70a4228058d90644
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            f56f424d-5eca-4bb4-ac84-eeb497dbdbc5.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f56f424d-5eca-4bb4-ac84-eeb497dbdbc5.tmp
                                                                                            • Size 70KB
                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            b7056efd-bd44-4fb8-85c8-f639eb6433ed.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7056efd-bd44-4fb8-85c8-f639eb6433ed.tmp
                                                                                            • Size 22KB
                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                            • Size 165B
                                                                                            • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                            • Size 43B
                                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
                                                                                            • Size 80B
                                                                                            • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                            • Size 160B
                                                                                            • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            a9779346-e8db-438b-b2f1-4a388f939322.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9779346-e8db-438b-b2f1-4a388f939322.tmp
                                                                                            • Size 8KB
                                                                                            • SHA256 80d17b84d5029236fd3dcf263d38c18ceb40219bbb7b3a3d6f6028f9bb29b973
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            3273e17d-b84c-494f-8cb8-d71db9092f06.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3273e17d-b84c-494f-8cb8-d71db9092f06.tmp
                                                                                            • Size 372B
                                                                                            • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            65d87932-5e25-4f49-86da-6121b75eac8d.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\65d87932-5e25-4f49-86da-6121b75eac8d.tmp
                                                                                            • Size 252B
                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            ecb8a385-c809-4c2b-bc52-ce2165f163f5.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ecb8a385-c809-4c2b-bc52-ce2165f163f5.tmp
                                                                                            • Size 492B
                                                                                            • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            fbc5149e-2f1a-4966-b3be-c1abffa75691.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\fbc5149e-2f1a-4966-b3be-c1abffa75691.tmp
                                                                                            • Size 132B
                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            d73f7ef5-14ab-4add-bc14-c70c5c132855.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d73f7ef5-14ab-4add-bc14-c70c5c132855.tmp
                                                                                            • Size 8KB
                                                                                            • SHA256 36145167e5719fa09eb6f24fa32b60cded5598b9056b59617e4e1e5d945cbab0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            d8c3754e-bbfb-4f05-bd75-59a57dfa1863.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8c3754e-bbfb-4f05-bd75-59a57dfa1863.tmp
                                                                                            • Size 18KB
                                                                                            • SHA256 766816b36e3fe820d648e261203a228d705ff198dfaa8078a916364189adfbf4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            b8672d68-8a75-4ba5-94bd-eaf9832a122c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b8672d68-8a75-4ba5-94bd-eaf9832a122c.tmp
                                                                                            • Size 13B
                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E2MWFLIO\hao.360[1].xml
                                                                                            • Size 2KB
                                                                                            • SHA256 d00c7c65c1fe0ad4f27d8b582dc346cae9c27873a0f427711da96d2a21aafe2d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E2MWFLIO\hao.360[1].xml
                                                                                            • Size 50KB
                                                                                            • SHA256 f64256777e16f009ebf8353a0cc74a7e0bccd33f65e2d6aa9f5b8ce561c4ab8f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E2MWFLIO\hao.360[1].xml
                                                                                            • Size 55KB
                                                                                            • SHA256 8f9cef5ff7a0ce3e96a6c50ac9d8bdf7be3a2b601df7f15b408df3c7e9043fea
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                            • Size 2KB
                                                                                            • SHA256 302eb197703011905c1c95cfc5d70ba3244fc9a8da18ae7788e1437aef63aaf0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            sed_api_weather_info[1].htm
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9GMOGYPF\sed_api_weather_info[1].htm
                                                                                            • Size 8KB
                                                                                            • SHA256 0af311670ae9d0ae7ad2f97538b361dd74180aedc8f963c71565328c25a8b2bf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            behavior[3].htm
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\behavior[3].htm
                                                                                            • Size 43B
                                                                                            • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            time[1].js
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\time[1].js
                                                                                            • Size 27B
                                                                                            • SHA256 986214f8897011926ab6cd9fc0b9a3c124dec970eaf457c5cc92b4703485235d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            0[1].png
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QYLG505P\0[1].png
                                                                                            • Size 574B
                                                                                            • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            QHCmHelp1.0.0.1[1].cab
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QYLG505P\QHCmHelp1.0.0.1[1].cab
                                                                                            • Size 199KB
                                                                                            • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ebb471a0-00bb-48f4-98e5-aef53b36b715.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ebb471a0-00bb-48f4-98e5-aef53b36b715.tmp
                                                                                            • Size 158KB
                                                                                            • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fe4b3033-05af-4a87-a898-23f815f3079c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fe4b3033-05af-4a87-a898-23f815f3079c.tmp
                                                                                            • Size 1B
                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            hhmkln.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\hhmkln.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 9b03cfc4987e343af2d6ae6d63c3f151c03ba74067a58a643c3f636a3d915129
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ldsajdklsajdlkjsalkda.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                            • Size 589B
                                                                                            • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            messages.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir216_1018643957\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                            • Size 711B
                                                                                            • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            content.js
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir216_881064504\CRX_INSTALL\content.js
                                                                                            • Size 9KB
                                                                                            • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            afc6eed2-90e4-4afa-8fe3-44cd24b0f82a.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir216_881064504\afc6eed2-90e4-4afa-8fe3-44cd24b0f82a.tmp
                                                                                            • Size 10KB
                                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            083099.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\083099.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 53fb86d0fb6e519cb6fbfff47e288f020080308b1431b573272e870f1453a3f9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            205375.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\205375.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 504f9e9b692ce2dd56313cb3071afef3a644fa8fa66eaa80ba03a0df63501ce1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            273050.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\273050.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 47e790e2cc965b47b467b04b665fb2726a1708ec64fc0e94ad0c23e2d4bea968
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            383421.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\383421.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 4f1f8fd2e616414857e216cad4c012fd687edfa5348be44dc8468f608bcb9ee1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            755193.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\755193.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 ea5b2d44ca6695abc4efe920acffa40647e81fe1a193c8c0a660df2bc749910c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            774762.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\774762.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 951652a569b3cc3bf41cae4a8847b284e228710e4a296fae663524f0650c4031
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            777479.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\777479.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 775b975b58d5d00c9063b45c70e44f7d1d98f95fe4abdd63751d13c164c3de5d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            796202.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\796202.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 e0b4ef3e9e1c1a185ab4424d8eca9d66d7714a17a4360d93c8a2f759b93461ac
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            880700.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\880700.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 1e8b45ce76c42148de3b3c929bbe3125418dc2989996d425fae8cc08233d2f57
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            946135.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\946135.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 823334e755b136b37244dfea9d8c9a1b895615d4cff63995cf3623761611ed56
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            964974.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\964974.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 aaf89bbeb0578f7d54608093d3b62117211815cad578b00e0cb0b015d6bb3e20
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            996230.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\996230.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 4114dc265ff6bb2fe08aae66fae208e0e91f1170d8e60178d2020a5102bf20dc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            memory/1388-130-0x000000000D830000-0x000000000D930000-memory.dmp
                                                                                            Download

                                                                                            memory/1388-148-0x000000000F780000-0x000000000F880000-memory.dmp
                                                                                            Download

                                                                                            memory/1584-270-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1317-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1548-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1486-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1605-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-350-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1656-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1440-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1387-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-911-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-1179-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download