Overview

overview

7

Static

static

3

2026-11-01...op.exe

windows10-2004-x64

7

2026-11-01...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_f62f77a2c93ac7dae80dcefc4b613b6d_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261102-dbrshagy3q
  • SHA256 d1d316ecf87b6ee8cda469e797d8d6a29fb1103f10fa834d93f15c36336b5257
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 52 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_f62f77a2c93ac7dae80dcefc4b613b6d_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_f62f77a2c93ac7dae80dcefc4b613b6d_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2892
    • C:\Users\Admin\AppData\Local\Temp\nsqzsn.exe
      "C:\Users\Admin\AppData\Local\Temp\nsqzsn.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Users\Admin\AppData\Local\Temp\nsqzsn.exe
        "C:\Users\Admin\AppData\Local\Temp\nsqzsn.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Users\Admin\AppData\Roaming\Download\861657.exe
          "C:\Users\Admin\AppData\Roaming\Download\861657.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Users\Admin\AppData\Roaming\Download\861657.exe
            "C:\Users\Admin\AppData\Roaming\Download\861657.exe"
            5⤵
            • Executes dropped EXE
            PID:1144
        • C:\Users\Admin\AppData\Roaming\Download\813734.exe
          "C:\Users\Admin\AppData\Roaming\Download\813734.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3772
          • C:\Users\Admin\AppData\Roaming\Download\813734.exe
            "C:\Users\Admin\AppData\Roaming\Download\813734.exe"
            5⤵
            • Executes dropped EXE
            PID:2644
        • C:\Users\Admin\AppData\Roaming\Download\202459.exe
          "C:\Users\Admin\AppData\Roaming\Download\202459.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:428
          • C:\Users\Admin\AppData\Roaming\Download\202459.exe
            "C:\Users\Admin\AppData\Roaming\Download\202459.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4876
        • C:\Users\Admin\AppData\Roaming\Download\692143.exe
          "C:\Users\Admin\AppData\Roaming\Download\692143.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5428
          • C:\Users\Admin\AppData\Roaming\Download\692143.exe
            "C:\Users\Admin\AppData\Roaming\Download\692143.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5916
        • C:\Users\Admin\AppData\Roaming\Download\531852.exe
          "C:\Users\Admin\AppData\Roaming\Download\531852.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6084
          • C:\Users\Admin\AppData\Roaming\Download\531852.exe
            "C:\Users\Admin\AppData\Roaming\Download\531852.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5336
        • C:\Users\Admin\AppData\Roaming\Download\583928.exe
          "C:\Users\Admin\AppData\Roaming\Download\583928.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6048
          • C:\Users\Admin\AppData\Roaming\Download\583928.exe
            "C:\Users\Admin\AppData\Roaming\Download\583928.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5104
        • C:\Users\Admin\AppData\Roaming\Download\760936.exe
          "C:\Users\Admin\AppData\Roaming\Download\760936.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5260
          • C:\Users\Admin\AppData\Roaming\Download\760936.exe
            "C:\Users\Admin\AppData\Roaming\Download\760936.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5400
        • C:\Users\Admin\AppData\Roaming\Download\651267.exe
          "C:\Users\Admin\AppData\Roaming\Download\651267.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5740
          • C:\Users\Admin\AppData\Roaming\Download\651267.exe
            "C:\Users\Admin\AppData\Roaming\Download\651267.exe"
            5⤵
            • Executes dropped EXE
            PID:5892
        • C:\Users\Admin\AppData\Roaming\Download\551204.exe
          "C:\Users\Admin\AppData\Roaming\Download\551204.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5648
          • C:\Users\Admin\AppData\Roaming\Download\551204.exe
            "C:\Users\Admin\AppData\Roaming\Download\551204.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5688
        • C:\Users\Admin\AppData\Roaming\Download\517087.exe
          "C:\Users\Admin\AppData\Roaming\Download\517087.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5872
          • C:\Users\Admin\AppData\Roaming\Download\517087.exe
            "C:\Users\Admin\AppData\Roaming\Download\517087.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6040
        • C:\Users\Admin\AppData\Roaming\Download\314512.exe
          "C:\Users\Admin\AppData\Roaming\Download\314512.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6056
          • C:\Users\Admin\AppData\Roaming\Download\314512.exe
            "C:\Users\Admin\AppData\Roaming\Download\314512.exe"
            5⤵
            • Executes dropped EXE
            PID:5988
        • C:\Users\Admin\AppData\Roaming\Download\772319.exe
          "C:\Users\Admin\AppData\Roaming\Download\772319.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5392
          • C:\Users\Admin\AppData\Roaming\Download\772319.exe
            "C:\Users\Admin\AppData\Roaming\Download\772319.exe"
            5⤵
            • Executes dropped EXE
            PID:5504
        • C:\Users\Admin\AppData\Roaming\Download\724477.exe
          "C:\Users\Admin\AppData\Roaming\Download\724477.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3832
          • C:\Users\Admin\AppData\Roaming\Download\724477.exe
            "C:\Users\Admin\AppData\Roaming\Download\724477.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1976
        • C:\Users\Admin\AppData\Roaming\Download\605926.exe
          "C:\Users\Admin\AppData\Roaming\Download\605926.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4436
          • C:\Users\Admin\AppData\Roaming\Download\605926.exe
            "C:\Users\Admin\AppData\Roaming\Download\605926.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5604
        • C:\Users\Admin\AppData\Roaming\Download\949284.exe
          "C:\Users\Admin\AppData\Roaming\Download\949284.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5624
          • C:\Users\Admin\AppData\Roaming\Download\949284.exe
            "C:\Users\Admin\AppData\Roaming\Download\949284.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5824
        • C:\Users\Admin\AppData\Roaming\Download\115082.exe
          "C:\Users\Admin\AppData\Roaming\Download\115082.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4396
          • C:\Users\Admin\AppData\Roaming\Download\115082.exe
            "C:\Users\Admin\AppData\Roaming\Download\115082.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6028
        • C:\Users\Admin\AppData\Roaming\Download\159168.exe
          "C:\Users\Admin\AppData\Roaming\Download\159168.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5760
          • C:\Users\Admin\AppData\Roaming\Download\159168.exe
            "C:\Users\Admin\AppData\Roaming\Download\159168.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4928
        • C:\Users\Admin\AppData\Roaming\Download\095967.exe
          "C:\Users\Admin\AppData\Roaming\Download\095967.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5296
          • C:\Users\Admin\AppData\Roaming\Download\095967.exe
            "C:\Users\Admin\AppData\Roaming\Download\095967.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1836
        • C:\Users\Admin\AppData\Roaming\Download\279058.exe
          "C:\Users\Admin\AppData\Roaming\Download\279058.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6088
          • C:\Users\Admin\AppData\Roaming\Download\279058.exe
            "C:\Users\Admin\AppData\Roaming\Download\279058.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5504
        • C:\Users\Admin\AppData\Roaming\Download\057682.exe
          "C:\Users\Admin\AppData\Roaming\Download\057682.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4268
          • C:\Users\Admin\AppData\Roaming\Download\057682.exe
            "C:\Users\Admin\AppData\Roaming\Download\057682.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5400
        • C:\Users\Admin\AppData\Roaming\Download\185565.exe
          "C:\Users\Admin\AppData\Roaming\Download\185565.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:396
          • C:\Users\Admin\AppData\Roaming\Download\185565.exe
            "C:\Users\Admin\AppData\Roaming\Download\185565.exe"
            5⤵
            • Executes dropped EXE
            PID:3544
        • C:\Users\Admin\AppData\Roaming\Download\182199.exe
          "C:\Users\Admin\AppData\Roaming\Download\182199.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6044
          • C:\Users\Admin\AppData\Roaming\Download\182199.exe
            "C:\Users\Admin\AppData\Roaming\Download\182199.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5908
        • C:\Users\Admin\AppData\Roaming\Download\105267.exe
          "C:\Users\Admin\AppData\Roaming\Download\105267.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3896
          • C:\Users\Admin\AppData\Roaming\Download\105267.exe
            "C:\Users\Admin\AppData\Roaming\Download\105267.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2524
        • C:\Users\Admin\AppData\Roaming\Download\024706.exe
          "C:\Users\Admin\AppData\Roaming\Download\024706.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5244
          • C:\Users\Admin\AppData\Roaming\Download\024706.exe
            "C:\Users\Admin\AppData\Roaming\Download\024706.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6136
        • C:\Users\Admin\AppData\Roaming\Download\266962.exe
          "C:\Users\Admin\AppData\Roaming\Download\266962.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5232
          • C:\Users\Admin\AppData\Roaming\Download\266962.exe
            "C:\Users\Admin\AppData\Roaming\Download\266962.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3996
        • C:\Users\Admin\AppData\Roaming\Download\249213.exe
          "C:\Users\Admin\AppData\Roaming\Download\249213.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1072
          • C:\Users\Admin\AppData\Roaming\Download\249213.exe
            "C:\Users\Admin\AppData\Roaming\Download\249213.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5508
        • C:\Users\Admin\AppData\Roaming\Download\292579.exe
          "C:\Users\Admin\AppData\Roaming\Download\292579.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3092
          • C:\Users\Admin\AppData\Roaming\Download\292579.exe
            "C:\Users\Admin\AppData\Roaming\Download\292579.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5692
        • C:\Users\Admin\AppData\Roaming\Download\414845.exe
          "C:\Users\Admin\AppData\Roaming\Download\414845.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3928
          • C:\Users\Admin\AppData\Roaming\Download\414845.exe
            "C:\Users\Admin\AppData\Roaming\Download\414845.exe"
            5⤵
            • Executes dropped EXE
            PID:5832
        • C:\Users\Admin\AppData\Roaming\Download\151907.exe
          "C:\Users\Admin\AppData\Roaming\Download\151907.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3496
          • C:\Users\Admin\AppData\Roaming\Download\151907.exe
            "C:\Users\Admin\AppData\Roaming\Download\151907.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4684
        • C:\Users\Admin\AppData\Roaming\Download\819626.exe
          "C:\Users\Admin\AppData\Roaming\Download\819626.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2328
          • C:\Users\Admin\AppData\Roaming\Download\819626.exe
            "C:\Users\Admin\AppData\Roaming\Download\819626.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2044
        • C:\Users\Admin\AppData\Roaming\Download\032982.exe
          "C:\Users\Admin\AppData\Roaming\Download\032982.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1320
          • C:\Users\Admin\AppData\Roaming\Download\032982.exe
            "C:\Users\Admin\AppData\Roaming\Download\032982.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5132
        • C:\Users\Admin\AppData\Roaming\Download\164048.exe
          "C:\Users\Admin\AppData\Roaming\Download\164048.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:5432
          • C:\Users\Admin\AppData\Roaming\Download\164048.exe
            "C:\Users\Admin\AppData\Roaming\Download\164048.exe"
            5⤵
              PID:4144
          • C:\Users\Admin\AppData\Roaming\Download\341046.exe
            "C:\Users\Admin\AppData\Roaming\Download\341046.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5468
            • C:\Users\Admin\AppData\Roaming\Download\341046.exe
              "C:\Users\Admin\AppData\Roaming\Download\341046.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2304
          • C:\Users\Admin\AppData\Roaming\Download\394122.exe
            "C:\Users\Admin\AppData\Roaming\Download\394122.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:532
            • C:\Users\Admin\AppData\Roaming\Download\394122.exe
              "C:\Users\Admin\AppData\Roaming\Download\394122.exe"
              5⤵
                PID:3632
            • C:\Users\Admin\AppData\Roaming\Download\232911.exe
              "C:\Users\Admin\AppData\Roaming\Download\232911.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              PID:5536
              • C:\Users\Admin\AppData\Roaming\Download\232911.exe
                "C:\Users\Admin\AppData\Roaming\Download\232911.exe"
                5⤵
                  PID:5368
              • C:\Users\Admin\AppData\Roaming\Download\254287.exe
                "C:\Users\Admin\AppData\Roaming\Download\254287.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3756
                • C:\Users\Admin\AppData\Roaming\Download\254287.exe
                  "C:\Users\Admin\AppData\Roaming\Download\254287.exe"
                  5⤵
                    PID:1464
                • C:\Users\Admin\AppData\Roaming\Download\645891.exe
                  "C:\Users\Admin\AppData\Roaming\Download\645891.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5884
                  • C:\Users\Admin\AppData\Roaming\Download\645891.exe
                    "C:\Users\Admin\AppData\Roaming\Download\645891.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1800
                • C:\Users\Admin\AppData\Roaming\Download\091874.exe
                  "C:\Users\Admin\AppData\Roaming\Download\091874.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:5000
                  • C:\Users\Admin\AppData\Roaming\Download\091874.exe
                    "C:\Users\Admin\AppData\Roaming\Download\091874.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3356
                • C:\Users\Admin\AppData\Roaming\Download\013130.exe
                  "C:\Users\Admin\AppData\Roaming\Download\013130.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:4928
                  • C:\Users\Admin\AppData\Roaming\Download\013130.exe
                    "C:\Users\Admin\AppData\Roaming\Download\013130.exe"
                    5⤵
                      PID:5596
                  • C:\Users\Admin\AppData\Roaming\Download\891564.exe
                    "C:\Users\Admin\AppData\Roaming\Download\891564.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:4048
                    • C:\Users\Admin\AppData\Roaming\Download\891564.exe
                      "C:\Users\Admin\AppData\Roaming\Download\891564.exe"
                      5⤵
                        PID:1716
                    • C:\Users\Admin\AppData\Roaming\Download\033850.exe
                      "C:\Users\Admin\AppData\Roaming\Download\033850.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4580
                      • C:\Users\Admin\AppData\Roaming\Download\033850.exe
                        "C:\Users\Admin\AppData\Roaming\Download\033850.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4252
                    • C:\Users\Admin\AppData\Roaming\Download\181712.exe
                      "C:\Users\Admin\AppData\Roaming\Download\181712.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4236
                      • C:\Users\Admin\AppData\Roaming\Download\181712.exe
                        "C:\Users\Admin\AppData\Roaming\Download\181712.exe"
                        5⤵
                          PID:3604
                      • C:\Users\Admin\AppData\Roaming\Download\204098.exe
                        "C:\Users\Admin\AppData\Roaming\Download\204098.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:3544
                        • C:\Users\Admin\AppData\Roaming\Download\204098.exe
                          "C:\Users\Admin\AppData\Roaming\Download\204098.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:3788
                      • C:\Users\Admin\AppData\Roaming\Download\491888.exe
                        "C:\Users\Admin\AppData\Roaming\Download\491888.exe" /Shorttailedrestart
                        4⤵
                        • Checks computer location settings
                        PID:3748
                        • C:\Users\Admin\AppData\Roaming\Download\491888.exe
                          "C:\Users\Admin\AppData\Roaming\Download\491888.exe"
                          5⤵
                            PID:5832
                        • C:\Users\Admin\AppData\Roaming\Download\826068.exe
                          "C:\Users\Admin\AppData\Roaming\Download\826068.exe" /Shorttailedrestart
                          4⤵
                          • Checks computer location settings
                          • System Location Discovery: System Language Discovery
                          PID:1056
                          • C:\Users\Admin\AppData\Roaming\Download\826068.exe
                            "C:\Users\Admin\AppData\Roaming\Download\826068.exe"
                            5⤵
                              PID:5476
                          • C:\Users\Admin\AppData\Roaming\Download\869134.exe
                            "C:\Users\Admin\AppData\Roaming\Download\869134.exe" /Shorttailedrestart
                            4⤵
                            • Checks computer location settings
                            PID:4712
                            • C:\Users\Admin\AppData\Roaming\Download\869134.exe
                              "C:\Users\Admin\AppData\Roaming\Download\869134.exe"
                              5⤵
                                PID:3356
                            • C:\Users\Admin\AppData\Roaming\Download\995117.exe
                              "C:\Users\Admin\AppData\Roaming\Download\995117.exe" /Shorttailedrestart
                              4⤵
                              • Checks computer location settings
                              • System Location Discovery: System Language Discovery
                              PID:2216
                              • C:\Users\Admin\AppData\Roaming\Download\995117.exe
                                "C:\Users\Admin\AppData\Roaming\Download\995117.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:4896
                            • C:\Users\Admin\AppData\Roaming\Download\237473.exe
                              "C:\Users\Admin\AppData\Roaming\Download\237473.exe" /Shorttailedrestart
                              4⤵
                              • Checks computer location settings
                              PID:5768
                              • C:\Users\Admin\AppData\Roaming\Download\237473.exe
                                "C:\Users\Admin\AppData\Roaming\Download\237473.exe"
                                5⤵
                                  PID:2292
                              • C:\Users\Admin\AppData\Roaming\Download\128824.exe
                                "C:\Users\Admin\AppData\Roaming\Download\128824.exe" /Shorttailedrestart
                                4⤵
                                • Checks computer location settings
                                PID:3372
                                • C:\Users\Admin\AppData\Roaming\Download\128824.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\128824.exe"
                                  5⤵
                                    PID:4708
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                              2⤵
                              • Drops file in Program Files directory
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Modifies registry class
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of WriteProcessMemory
                              PID:3764
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x34c,0x7ffe1bfec188,0x7ffe1bfec194,0x7ffe1bfec1a0
                                3⤵
                                  PID:544
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,7270069729516066782,15501673845552795311,262144 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
                                  3⤵
                                    PID:4340
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,15221371297286880470,2658996723326062442,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:3
                                    3⤵
                                    • System Time Discovery
                                    PID:3312
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,4753199571905577076,11885578778543697894,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
                                    3⤵
                                      PID:1816
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3243662747438527828,13878516142944119036,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                                      3⤵
                                        PID:428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,15657700577168123347,667370663257658655,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                        3⤵
                                          PID:2368
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,14923459143639956787,8683315517570555048,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                                          3⤵
                                            PID:4360
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8879497510714203427,4998426215196646406,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
                                            3⤵
                                              PID:2824
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11113352841928240371,2258080008029999862,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
                                              3⤵
                                                PID:5096
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,11583298014495849463,16507447970168289616,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
                                                3⤵
                                                  PID:2592
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11408990489717461610,14970643819940048098,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
                                                  3⤵
                                                    PID:512
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2842323499715082812,11302083702517691800,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
                                                    3⤵
                                                      PID:3260
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5642617719407783291,377021840501401791,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
                                                      3⤵
                                                        PID:2780
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5642617719407783291,377021840501401791,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
                                                        3⤵
                                                          PID:4872
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,14398316748539687976,6036296848868580547,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
                                                          3⤵
                                                            PID:4636
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,882604827120695640,6943248528223756068,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
                                                            3⤵
                                                              PID:5204
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9884872136676478445,14526175518849822077,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
                                                              3⤵
                                                                PID:5512
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5060276576310936617,17373151772551405012,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
                                                                3⤵
                                                                  PID:5520
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,7358540471097180390,7885578080256228572,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
                                                                  3⤵
                                                                    PID:6036
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6708,i,17426079904476024848,12334067594429681430,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
                                                                    3⤵
                                                                      PID:5156
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,7097980737343417286,14412685143114648771,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
                                                                      3⤵
                                                                        PID:5240
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,11550077501830680143,2771188309686579058,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
                                                                        3⤵
                                                                        • Modifies registry class
                                                                        PID:5272
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6580,i,14000597762586854536,2755691595485387552,2097152 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
                                                                        3⤵
                                                                          PID:5532
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,8656600325268630778,13859669028441230633,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
                                                                          3⤵
                                                                            PID:2192
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,7542685977380608023,12273637479918478617,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
                                                                            3⤵
                                                                              PID:1716
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,5830144056558652932,16479635225308223451,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
                                                                              3⤵
                                                                                PID:5916
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,3326097998328169929,16459421464101616208,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
                                                                                3⤵
                                                                                  PID:5672
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,3095344030602721904,6853141599867412223,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                                                                                  3⤵
                                                                                    PID:3388
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,13795159887182142471,2100736780420073610,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                                                                                    3⤵
                                                                                      PID:548
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,9653507307668403307,18105331498323886564,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
                                                                                      3⤵
                                                                                        PID:4348
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5340,i,10605542755323402321,17004814585859806916,262144 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
                                                                                        3⤵
                                                                                          PID:5456
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,17512807286632112683,2196643705440210081,524288 --field-trial-handle=2824,i,9642386776395193212,2901650125607787052,262144 --variations-seed-version --mojo-platform-channel-handle=1140 /prefetch:8
                                                                                          3⤵
                                                                                            PID:2932
                                                                                        • C:\Windows\explorer.exe
                                                                                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                          2⤵
                                                                                            PID:4244
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                          1⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1764
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:1688
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:1952

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                DouTuDaShi.exe
                                                                                                • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                • Size 1.1MB
                                                                                                • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                nav_config.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3764_1319148240\nav_config.json
                                                                                                • Size 2KB
                                                                                                • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                protocols.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3764_1634158584\protocols.json
                                                                                                • Size 3KB
                                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                llm_user_input_extractor_config.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3764_742805773\llm_user_input_extractor_config.json
                                                                                                • Size 4KB
                                                                                                • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                office_endpoints_list.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3764_742805773\office_endpoints_list.json
                                                                                                • Size 9KB
                                                                                                • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                smart_switch_list.json
                                                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3764_742805773\smart_switch_list.json
                                                                                                • Size 2KB
                                                                                                • SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                3f55175b-d7ab-4719-a65c-68d98206362d.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f55175b-d7ab-4719-a65c-68d98206362d.tmp
                                                                                                • Size 18KB
                                                                                                • SHA256 e78fa85c22bafd521b3681ff1ee1341f913951012e4bc8cb400d547f08587c62
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                57253420-876c-4085-9936-0756b3efd47d.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57253420-876c-4085-9936-0756b3efd47d.tmp
                                                                                                • Size 28KB
                                                                                                • SHA256 10ac0ec508c13a0c119a67a0dd7a2f9cdc8ed78ffbe7e85ad7fc3ea063e14f1c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                6215753a-e0b0-4f68-9639-d9a903f1e7eb.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6215753a-e0b0-4f68-9639-d9a903f1e7eb.tmp
                                                                                                • Size 18KB
                                                                                                • SHA256 b47cbe97b755cc247b8942aeb76343aea1c6231f3703fd7d199faaa688f106ae
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                                • Size 135B
                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                0879f140-b426-4369-a854-2bccbb83f88b.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0879f140-b426-4369-a854-2bccbb83f88b.tmp
                                                                                                • Size 11KB
                                                                                                • SHA256 85dfa69139632e666dae962429983e2993af8f9487bb2b4defe0e4555965fbc1
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                0f89641d-1c67-46de-8496-19cc0e084d4f.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f89641d-1c67-46de-8496-19cc0e084d4f.tmp
                                                                                                • Size 12KB
                                                                                                • SHA256 0a7187db9d8f18fed00730871594a87f8403209e4d7d77082b7750858358554b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                115de7d5-23bd-4810-b072-7091d018db7e.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\115de7d5-23bd-4810-b072-7091d018db7e.tmp
                                                                                                • Size 11KB
                                                                                                • SHA256 774dbb066039a04d1c8466a2bfb6ae80e45a1504ab6119ed77d3e439aa2b148e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                • Size 6B
                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                f_000047
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
                                                                                                • Size 61KB
                                                                                                • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                temp-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                • Size 4KB
                                                                                                • SHA256 b77c0cdc49d0e8ce1ff97ea9ab5fbdd26548aa27c3e9c18ede97568b87b6cd23
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                temp-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                • Size 4KB
                                                                                                • SHA256 fba5c8e160998216cd7ed12b4000b0677cc9f71fc2d54fcc1e91bbc184aba1bb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ac2b31f2-e028-4636-a1ac-2b36b1f569b1.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ac2b31f2-e028-4636-a1ac-2b36b1f569b1.tmp
                                                                                                • Size 2B
                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                dasherSettingSchema.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                • Size 854B
                                                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                0ec19bbe-ebf7-464d-aa89-3e86fb8c43e6.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ec19bbe-ebf7-464d-aa89-3e86fb8c43e6.tmp
                                                                                                • Size 2B
                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                d8c3532c-5ddc-4e83-ba3e-cfd2f0fbe808.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8c3532c-5ddc-4e83-ba3e-cfd2f0fbe808.tmp
                                                                                                • Size 111B
                                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                e22ada2f-e2b6-4e8b-ae36-1094de7dceab.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e22ada2f-e2b6-4e8b-ae36-1094de7dceab.tmp
                                                                                                • Size 5KB
                                                                                                • SHA256 4eb4aa9bf9c6fc949028abc17891c09e21afa26589664608aa1f92f3e2e1820f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sync_diagnostic.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                • Size 4KB
                                                                                                • SHA256 3c24ba566f89376d7f18ff658672f4de76fdd8a7cd4baf10c84624b2c07f0077
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ded4c2fc-579b-4144-b82d-f5fae7142e1d.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ded4c2fc-579b-4144-b82d-f5fae7142e1d.tmp
                                                                                                • Size 70KB
                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                f918ca37-9c46-4c4c-8b5d-27f5b38fd8ae.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f918ca37-9c46-4c4c-8b5d-27f5b38fd8ae.tmp
                                                                                                • Size 32KB
                                                                                                • SHA256 429e12d87939256c0c71f484945692becae17f4c20ef94ce4c2018b4b6c6fe5a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                07aba5b5-71ce-422e-a99f-cfc2ebf51920.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\07aba5b5-71ce-422e-a99f-cfc2ebf51920.tmp
                                                                                                • Size 22KB
                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
                                                                                                • Size 165B
                                                                                                • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                • Size 43B
                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                                • Size 160B
                                                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                69c9d930-6731-424b-bb16-63f5725dc3dd.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\69c9d930-6731-424b-bb16-63f5725dc3dd.tmp
                                                                                                • Size 372B
                                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                715c6ba4-707d-46b9-9b7a-1451afeda587.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\715c6ba4-707d-46b9-9b7a-1451afeda587.tmp
                                                                                                • Size 132B
                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                7f49c224-154f-481c-a26d-66e730559b89.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7f49c224-154f-481c-a26d-66e730559b89.tmp
                                                                                                • Size 252B
                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                d758c495-8d9c-40c1-b5e4-dc73c28e69fd.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d758c495-8d9c-40c1-b5e4-dc73c28e69fd.tmp
                                                                                                • Size 8KB
                                                                                                • SHA256 7e04cb3380c655b4a242ad076c9968b7c15f5686e8f5d82c2a93272d07e56f08
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                e90fad5c-cc46-40d9-9e34-b393cbc09325.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e90fad5c-cc46-40d9-9e34-b393cbc09325.tmp
                                                                                                • Size 8KB
                                                                                                • SHA256 c5b4d7be1cfc4e714af44ece5d7d56b94af8d8a5025952b6eadd2d4e18a75b7f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                7ccd093c-580e-4b2a-a13e-90b8f83759a3.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ccd093c-580e-4b2a-a13e-90b8f83759a3.tmp
                                                                                                • Size 13B
                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\XS0LAXDW\hao.360[1].xml
                                                                                                • Size 666B
                                                                                                • SHA256 51bfaddf4fc946d6a8ebb6d25c208b8b0f8f7e2f4642d38036f0cedf232bfb1c
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\XS0LAXDW\hao.360[1].xml
                                                                                                • Size 2KB
                                                                                                • SHA256 f76e47d650e4d8a207ca9e2e9df01ca98522d13586ca972d5f2a1538377ea831
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\XS0LAXDW\hao.360[1].xml
                                                                                                • Size 50KB
                                                                                                • SHA256 9aac2c04abb29829b6a728adbc62c64f80c39bb137ff65a12b0ea4e9b684c3ad
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                hao.360[1].xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\XS0LAXDW\hao.360[1].xml
                                                                                                • Size 55KB
                                                                                                • SHA256 a01fde54dbc12817b42deb6171178829bc85725f068af60fd132c95fb770efc3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Size 2KB
                                                                                                • SHA256 80b0050ffa2039029f793483880075b70adf6fb252c5dacaabceb7d5698e8cae
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                0[1].png
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OA8BQZYH\0[1].png
                                                                                                • Size 574B
                                                                                                • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                time[1].js
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OA8BQZYH\time[1].js
                                                                                                • Size 27B
                                                                                                • SHA256 bc84d8b52daedde31bf5aac7cad69f677076b40a1b7eafb3a8d5667d13777177
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                QHCmHelp1.0.0.1[1].cab
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\QHCmHelp1.0.0.1[1].cab
                                                                                                • Size 199KB
                                                                                                • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                behavior[3].htm
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\behavior[3].htm
                                                                                                • Size 43B
                                                                                                • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                sed_api_weather_info[1].htm
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR6ZW6LX\sed_api_weather_info[1].htm
                                                                                                • Size 7KB
                                                                                                • SHA256 c65c75342142898ebde69483e161c8037c4050907c1e83796ef68f233e0914e3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                a8781065-22c6-4eab-b025-5533b5862898.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a8781065-22c6-4eab-b025-5533b5862898.tmp
                                                                                                • Size 158KB
                                                                                                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                b20775b7-2fda-4951-8afd-acd8eb47b6a3.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b20775b7-2fda-4951-8afd-acd8eb47b6a3.tmp
                                                                                                • Size 1B
                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                ldsajdklsajdlkjsalkda.bat
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                • Size 589B
                                                                                                • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                nsqzsn.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsqzsn.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 d1d316ecf87b6ee8cda469e797d8d6a29fb1103f10fa834d93f15c36336b5257
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                messages.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3764_1473000888\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                • Size 711B
                                                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                46bca6ba-5efb-47e5-b7d3-86cbdffa7215.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3764_64275187\46bca6ba-5efb-47e5-b7d3-86cbdffa7215.tmp
                                                                                                • Size 10KB
                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                content.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3764_64275187\CRX_INSTALL\content.js
                                                                                                • Size 9KB
                                                                                                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                202459.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\202459.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 002dce1917c9a5774ac8943120ef2e97c7a32a722f22289545225cba2a0cc09b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                314512.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\314512.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 a2cf590117176b1dea123c4470181b60eed3648fea11e4cf5517b1dcc59c6d10
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                517087.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\517087.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 b7373053a0e9534454fef6285fc92c630e328efaf4da1b6bb2bf5fdc780ddab5
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                531852.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\531852.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 20f2ca34e4ad9fdf459c6b4929bc337f7f947b5d10e75f5eba91d21d157aa16b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                551204.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\551204.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 641dafee7c44a61b3be28bd707df5fd9e43116c3c2e216cb19420bb7f5aca94a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                583928.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\583928.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 c28b12713abee4ed5659e2d3d0b418910a0a6d3c2df453d58b5a40f805973f61
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                651267.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\651267.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 fa3f31152301c5a8cf1f065933f97f27096b2c79bf0da97e12e15a80bf194f30
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                692143.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\692143.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 a817c986df0f0c6e3631a3f55ae1d0fad72921ebafd757977c4a04db375d78db
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                760936.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\760936.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 a3ea77a8e3fc2a396ab33f7d118ded0355b7573020673ec8f89a1c3f7925ec3a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                772319.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\772319.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 c0feda6b679fd5583dc55c907ebb1cdb0b258279a662b927ff4bdedc5fb4e5ff
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                813734.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\813734.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 5b86ca49fe3ddc8943b5ad2730ad103cbe6391e05d94640f15ce5e63502990ab
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                861657.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Download\861657.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 fc4cd5c25082e06df43690652f27248aee3bfc2a8216c205cd9d82c90c4c685c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/768-1273-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1554-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1511-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1611-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1455-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1665-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1404-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-656-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-894-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1122-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/768-1719-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download

                                                                                                memory/1236-234-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                Download