Overview

overview

10

Static

static

10

2026-04-21...op.exe

windows10-2004-x64

10

2026-04-21...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 03:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_60b62dfd6ac43fdd4a4efdd151ac803e_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260421-d7x96abs2w
  • SHA256 2945155e1690e3f56c26cff58045204108a775a4e79a79d72d1e09a5ab25424c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebankerdefense_evasiondiscoveryblackmoonspywaretrojan

Malware Config

Signatures

  • Family: Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 19 IoCs
  • Checks computer location settings 2 TTPs 52 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_60b62dfd6ac43fdd4a4efdd151ac803e_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_60b62dfd6ac43fdd4a4efdd151ac803e_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4164
    • C:\Users\Admin\AppData\Local\Temp\okftor.exe
      "C:\Users\Admin\AppData\Local\Temp\okftor.exe" /jscxyxztjkl
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\okftor.exe
        "C:\Users\Admin\AppData\Local\Temp\okftor.exe" /jsjczxztcq
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Users\Admin\AppData\Roaming\Download\167288.exe
          "C:\Users\Admin\AppData\Roaming\Download\167288.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Users\Admin\AppData\Roaming\Download\167288.exe
            "C:\Users\Admin\AppData\Roaming\Download\167288.exe"
            5⤵
            • Executes dropped EXE
            PID:4292
        • C:\Users\Admin\AppData\Roaming\Download\529972.exe
          "C:\Users\Admin\AppData\Roaming\Download\529972.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:696
          • C:\Users\Admin\AppData\Roaming\Download\529972.exe
            "C:\Users\Admin\AppData\Roaming\Download\529972.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1380
        • C:\Users\Admin\AppData\Roaming\Download\642040.exe
          "C:\Users\Admin\AppData\Roaming\Download\642040.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Users\Admin\AppData\Roaming\Download\642040.exe
            "C:\Users\Admin\AppData\Roaming\Download\642040.exe"
            5⤵
            • Executes dropped EXE
            PID:740
        • C:\Users\Admin\AppData\Roaming\Download\039058.exe
          "C:\Users\Admin\AppData\Roaming\Download\039058.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5212
          • C:\Users\Admin\AppData\Roaming\Download\039058.exe
            "C:\Users\Admin\AppData\Roaming\Download\039058.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5744
        • C:\Users\Admin\AppData\Roaming\Download\817482.exe
          "C:\Users\Admin\AppData\Roaming\Download\817482.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Users\Admin\AppData\Roaming\Download\817482.exe
            "C:\Users\Admin\AppData\Roaming\Download\817482.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5152
        • C:\Users\Admin\AppData\Roaming\Download\859748.exe
          "C:\Users\Admin\AppData\Roaming\Download\859748.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5744
          • C:\Users\Admin\AppData\Roaming\Download\859748.exe
            "C:\Users\Admin\AppData\Roaming\Download\859748.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6008
        • C:\Users\Admin\AppData\Roaming\Download\240362.exe
          "C:\Users\Admin\AppData\Roaming\Download\240362.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5352
          • C:\Users\Admin\AppData\Roaming\Download\240362.exe
            "C:\Users\Admin\AppData\Roaming\Download\240362.exe"
            5⤵
            • Executes dropped EXE
            PID:5544
        • C:\Users\Admin\AppData\Roaming\Download\225088.exe
          "C:\Users\Admin\AppData\Roaming\Download\225088.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5932
          • C:\Users\Admin\AppData\Roaming\Download\225088.exe
            "C:\Users\Admin\AppData\Roaming\Download\225088.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5972
        • C:\Users\Admin\AppData\Roaming\Download\729516.exe
          "C:\Users\Admin\AppData\Roaming\Download\729516.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6120
          • C:\Users\Admin\AppData\Roaming\Download\729516.exe
            "C:\Users\Admin\AppData\Roaming\Download\729516.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3572
        • C:\Users\Admin\AppData\Roaming\Download\883597.exe
          "C:\Users\Admin\AppData\Roaming\Download\883597.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1584
          • C:\Users\Admin\AppData\Roaming\Download\883597.exe
            "C:\Users\Admin\AppData\Roaming\Download\883597.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5412
        • C:\Users\Admin\AppData\Roaming\Download\035855.exe
          "C:\Users\Admin\AppData\Roaming\Download\035855.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1968
          • C:\Users\Admin\AppData\Roaming\Download\035855.exe
            "C:\Users\Admin\AppData\Roaming\Download\035855.exe"
            5⤵
            • Executes dropped EXE
            PID:3828
        • C:\Users\Admin\AppData\Roaming\Download\763574.exe
          "C:\Users\Admin\AppData\Roaming\Download\763574.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5856
          • C:\Users\Admin\AppData\Roaming\Download\763574.exe
            "C:\Users\Admin\AppData\Roaming\Download\763574.exe"
            5⤵
            • Executes dropped EXE
            PID:5304
        • C:\Users\Admin\AppData\Roaming\Download\265103.exe
          "C:\Users\Admin\AppData\Roaming\Download\265103.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6140
          • C:\Users\Admin\AppData\Roaming\Download\265103.exe
            "C:\Users\Admin\AppData\Roaming\Download\265103.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5376
        • C:\Users\Admin\AppData\Roaming\Download\752991.exe
          "C:\Users\Admin\AppData\Roaming\Download\752991.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4136
          • C:\Users\Admin\AppData\Roaming\Download\752991.exe
            "C:\Users\Admin\AppData\Roaming\Download\752991.exe"
            5⤵
            • Executes dropped EXE
            PID:2892
        • C:\Users\Admin\AppData\Roaming\Download\775067.exe
          "C:\Users\Admin\AppData\Roaming\Download\775067.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4660
          • C:\Users\Admin\AppData\Roaming\Download\775067.exe
            "C:\Users\Admin\AppData\Roaming\Download\775067.exe"
            5⤵
            • Executes dropped EXE
            PID:5812
        • C:\Users\Admin\AppData\Roaming\Download\727323.exe
          "C:\Users\Admin\AppData\Roaming\Download\727323.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5572
          • C:\Users\Admin\AppData\Roaming\Download\727323.exe
            "C:\Users\Admin\AppData\Roaming\Download\727323.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4900
        • C:\Users\Admin\AppData\Roaming\Download\797959.exe
          "C:\Users\Admin\AppData\Roaming\Download\797959.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2636
          • C:\Users\Admin\AppData\Roaming\Download\797959.exe
            "C:\Users\Admin\AppData\Roaming\Download\797959.exe"
            5⤵
            • Executes dropped EXE
            PID:5232
        • C:\Users\Admin\AppData\Roaming\Download\575483.exe
          "C:\Users\Admin\AppData\Roaming\Download\575483.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3944
          • C:\Users\Admin\AppData\Roaming\Download\575483.exe
            "C:\Users\Admin\AppData\Roaming\Download\575483.exe"
            5⤵
            • Executes dropped EXE
            PID:624
        • C:\Users\Admin\AppData\Roaming\Download\517569.exe
          "C:\Users\Admin\AppData\Roaming\Download\517569.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4348
          • C:\Users\Admin\AppData\Roaming\Download\517569.exe
            "C:\Users\Admin\AppData\Roaming\Download\517569.exe"
            5⤵
            • Executes dropped EXE
            PID:4184
        • C:\Users\Admin\AppData\Roaming\Download\397193.exe
          "C:\Users\Admin\AppData\Roaming\Download\397193.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5480
          • C:\Users\Admin\AppData\Roaming\Download\397193.exe
            "C:\Users\Admin\AppData\Roaming\Download\397193.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5380
        • C:\Users\Admin\AppData\Roaming\Download\519469.exe
          "C:\Users\Admin\AppData\Roaming\Download\519469.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2384
          • C:\Users\Admin\AppData\Roaming\Download\519469.exe
            "C:\Users\Admin\AppData\Roaming\Download\519469.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2804
        • C:\Users\Admin\AppData\Roaming\Download\807257.exe
          "C:\Users\Admin\AppData\Roaming\Download\807257.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5868
          • C:\Users\Admin\AppData\Roaming\Download\807257.exe
            "C:\Users\Admin\AppData\Roaming\Download\807257.exe"
            5⤵
            • Executes dropped EXE
            PID:6072
        • C:\Users\Admin\AppData\Roaming\Download\829515.exe
          "C:\Users\Admin\AppData\Roaming\Download\829515.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:216
          • C:\Users\Admin\AppData\Roaming\Download\829515.exe
            "C:\Users\Admin\AppData\Roaming\Download\829515.exe"
            5⤵
            • Executes dropped EXE
            PID:5336
        • C:\Users\Admin\AppData\Roaming\Download\787134.exe
          "C:\Users\Admin\AppData\Roaming\Download\787134.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3804
          • C:\Users\Admin\AppData\Roaming\Download\787134.exe
            "C:\Users\Admin\AppData\Roaming\Download\787134.exe"
            5⤵
            • Executes dropped EXE
            PID:3428
        • C:\Users\Admin\AppData\Roaming\Download\710490.exe
          "C:\Users\Admin\AppData\Roaming\Download\710490.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:116
          • C:\Users\Admin\AppData\Roaming\Download\710490.exe
            "C:\Users\Admin\AppData\Roaming\Download\710490.exe"
            5⤵
            • Executes dropped EXE
            PID:1228
        • C:\Users\Admin\AppData\Roaming\Download\994571.exe
          "C:\Users\Admin\AppData\Roaming\Download\994571.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1572
          • C:\Users\Admin\AppData\Roaming\Download\994571.exe
            "C:\Users\Admin\AppData\Roaming\Download\994571.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:656
        • C:\Users\Admin\AppData\Roaming\Download\830180.exe
          "C:\Users\Admin\AppData\Roaming\Download\830180.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5928
          • C:\Users\Admin\AppData\Roaming\Download\830180.exe
            "C:\Users\Admin\AppData\Roaming\Download\830180.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5304
        • C:\Users\Admin\AppData\Roaming\Download\852456.exe
          "C:\Users\Admin\AppData\Roaming\Download\852456.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:6084
          • C:\Users\Admin\AppData\Roaming\Download\852456.exe
            "C:\Users\Admin\AppData\Roaming\Download\852456.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1344
        • C:\Users\Admin\AppData\Roaming\Download\897712.exe
          "C:\Users\Admin\AppData\Roaming\Download\897712.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3648
          • C:\Users\Admin\AppData\Roaming\Download\897712.exe
            "C:\Users\Admin\AppData\Roaming\Download\897712.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4884
        • C:\Users\Admin\AppData\Roaming\Download\874168.exe
          "C:\Users\Admin\AppData\Roaming\Download\874168.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5336
          • C:\Users\Admin\AppData\Roaming\Download\874168.exe
            "C:\Users\Admin\AppData\Roaming\Download\874168.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5492
        • C:\Users\Admin\AppData\Roaming\Download\897424.exe
          "C:\Users\Admin\AppData\Roaming\Download\897424.exe" /Shorttailedrestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5192
          • C:\Users\Admin\AppData\Roaming\Download\897424.exe
            "C:\Users\Admin\AppData\Roaming\Download\897424.exe"
            5⤵
              PID:3224
          • C:\Users\Admin\AppData\Roaming\Download\184122.exe
            "C:\Users\Admin\AppData\Roaming\Download\184122.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4552
            • C:\Users\Admin\AppData\Roaming\Download\184122.exe
              "C:\Users\Admin\AppData\Roaming\Download\184122.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3492
          • C:\Users\Admin\AppData\Roaming\Download\065673.exe
            "C:\Users\Admin\AppData\Roaming\Download\065673.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5840
            • C:\Users\Admin\AppData\Roaming\Download\065673.exe
              "C:\Users\Admin\AppData\Roaming\Download\065673.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5280
          • C:\Users\Admin\AppData\Roaming\Download\104012.exe
            "C:\Users\Admin\AppData\Roaming\Download\104012.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:4768
            • C:\Users\Admin\AppData\Roaming\Download\104012.exe
              "C:\Users\Admin\AppData\Roaming\Download\104012.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5916
          • C:\Users\Admin\AppData\Roaming\Download\129178.exe
            "C:\Users\Admin\AppData\Roaming\Download\129178.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:1864
            • C:\Users\Admin\AppData\Roaming\Download\129178.exe
              "C:\Users\Admin\AppData\Roaming\Download\129178.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5140
          • C:\Users\Admin\AppData\Roaming\Download\906702.exe
            "C:\Users\Admin\AppData\Roaming\Download\906702.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:372
            • C:\Users\Admin\AppData\Roaming\Download\906702.exe
              "C:\Users\Admin\AppData\Roaming\Download\906702.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4076
          • C:\Users\Admin\AppData\Roaming\Download\149070.exe
            "C:\Users\Admin\AppData\Roaming\Download\149070.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            PID:3832
            • C:\Users\Admin\AppData\Roaming\Download\149070.exe
              "C:\Users\Admin\AppData\Roaming\Download\149070.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1364
          • C:\Users\Admin\AppData\Roaming\Download\161136.exe
            "C:\Users\Admin\AppData\Roaming\Download\161136.exe" /Shorttailedrestart
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:176
            • C:\Users\Admin\AppData\Roaming\Download\161136.exe
              "C:\Users\Admin\AppData\Roaming\Download\161136.exe"
              5⤵
                PID:5272
            • C:\Users\Admin\AppData\Roaming\Download\214412.exe
              "C:\Users\Admin\AppData\Roaming\Download\214412.exe" /Shorttailedrestart
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5676
              • C:\Users\Admin\AppData\Roaming\Download\214412.exe
                "C:\Users\Admin\AppData\Roaming\Download\214412.exe"
                5⤵
                  PID:4940
              • C:\Users\Admin\AppData\Roaming\Download\397743.exe
                "C:\Users\Admin\AppData\Roaming\Download\397743.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                PID:3512
                • C:\Users\Admin\AppData\Roaming\Download\397743.exe
                  "C:\Users\Admin\AppData\Roaming\Download\397743.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2668
              • C:\Users\Admin\AppData\Roaming\Download\443825.exe
                "C:\Users\Admin\AppData\Roaming\Download\443825.exe" /Shorttailedrestart
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3492
                • C:\Users\Admin\AppData\Roaming\Download\443825.exe
                  "C:\Users\Admin\AppData\Roaming\Download\443825.exe"
                  5⤵
                    PID:1676
                • C:\Users\Admin\AppData\Roaming\Download\606826.exe
                  "C:\Users\Admin\AppData\Roaming\Download\606826.exe" /Shorttailedrestart
                  4⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:4192
                  • C:\Users\Admin\AppData\Roaming\Download\606826.exe
                    "C:\Users\Admin\AppData\Roaming\Download\606826.exe"
                    5⤵
                      PID:3728
                  • C:\Users\Admin\AppData\Roaming\Download\343536.exe
                    "C:\Users\Admin\AppData\Roaming\Download\343536.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:1780
                    • C:\Users\Admin\AppData\Roaming\Download\343536.exe
                      "C:\Users\Admin\AppData\Roaming\Download\343536.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:6100
                  • C:\Users\Admin\AppData\Roaming\Download\730533.exe
                    "C:\Users\Admin\AppData\Roaming\Download\730533.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:1068
                    • C:\Users\Admin\AppData\Roaming\Download\730533.exe
                      "C:\Users\Admin\AppData\Roaming\Download\730533.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4924
                  • C:\Users\Admin\AppData\Roaming\Download\510967.exe
                    "C:\Users\Admin\AppData\Roaming\Download\510967.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    PID:1212
                    • C:\Users\Admin\AppData\Roaming\Download\510967.exe
                      "C:\Users\Admin\AppData\Roaming\Download\510967.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3320
                  • C:\Users\Admin\AppData\Roaming\Download\307592.exe
                    "C:\Users\Admin\AppData\Roaming\Download\307592.exe" /Shorttailedrestart
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5492
                    • C:\Users\Admin\AppData\Roaming\Download\307592.exe
                      "C:\Users\Admin\AppData\Roaming\Download\307592.exe"
                      5⤵
                        PID:4232
                    • C:\Users\Admin\AppData\Roaming\Download\530850.exe
                      "C:\Users\Admin\AppData\Roaming\Download\530850.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4492
                      • C:\Users\Admin\AppData\Roaming\Download\530850.exe
                        "C:\Users\Admin\AppData\Roaming\Download\530850.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4940
                    • C:\Users\Admin\AppData\Roaming\Download\572916.exe
                      "C:\Users\Admin\AppData\Roaming\Download\572916.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:1652
                      • C:\Users\Admin\AppData\Roaming\Download\572916.exe
                        "C:\Users\Admin\AppData\Roaming\Download\572916.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5512
                    • C:\Users\Admin\AppData\Roaming\Download\849913.exe
                      "C:\Users\Admin\AppData\Roaming\Download\849913.exe" /Shorttailedrestart
                      4⤵
                      • Checks computer location settings
                      PID:4556
                      • C:\Users\Admin\AppData\Roaming\Download\849913.exe
                        "C:\Users\Admin\AppData\Roaming\Download\849913.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:452
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                  2⤵
                  • Drops file in Program Files directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3288
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffff055c188,0x7ffff055c194,0x7ffff055c1a0
                    3⤵
                      PID:4676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,15181649152738876790,16259479028390906411,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
                      3⤵
                      • System Time Discovery
                      PID:4704
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,12523637422338347622,4762414209684042798,262144 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
                      3⤵
                        PID:1744
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,13921384971589712104,7165952393676640714,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
                        3⤵
                          PID:2372
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,1551215482466592887,10020092110504729605,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                          3⤵
                            PID:1692
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,452727317181017056,10683853744062104373,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                            3⤵
                              PID:4884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,13243165356475210575,12504817449986128013,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                              3⤵
                                PID:2128
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,9869191363644136312,141914409982487500,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
                                3⤵
                                  PID:4932
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,9226688934397994027,4833209709141770320,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                                  3⤵
                                    PID:4104
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,17141275578433071465,10800982068251047998,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
                                    3⤵
                                      PID:2256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5108,i,2283703177705016689,15763013751139547361,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
                                      3⤵
                                        PID:740
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11202001537126535742,18320159896914760853,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
                                        3⤵
                                          PID:2028
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,16667741638608004049,6707443383986169822,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
                                          3⤵
                                            PID:3888
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11973801995885031286,18121309552096674754,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
                                            3⤵
                                              PID:4024
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11973801995885031286,18121309552096674754,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
                                              3⤵
                                                PID:1228
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6751234944425741948,17810898686690780443,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
                                                3⤵
                                                  PID:1532
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,2353422881855096268,8795187801376535009,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
                                                  3⤵
                                                    PID:336
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,13447068230577259652,9705229149046532313,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
                                                    3⤵
                                                      PID:5400
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,10878002898518458906,3391039300963777164,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
                                                      3⤵
                                                        PID:5424
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,7491680042620862959,8767073187833701473,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
                                                        3⤵
                                                          PID:5964
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,7255819431959944422,313837843158947969,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
                                                          3⤵
                                                            PID:5604
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,12785701191395836659,5615387830702857113,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
                                                            3⤵
                                                            • Modifies registry class
                                                            PID:5584
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6644,i,6152435888930468020,2423741893122469237,2097152 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
                                                            3⤵
                                                              PID:5536
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,4185764455309931955,7268465678589600363,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
                                                              3⤵
                                                                PID:5876
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,14617256081927932806,7104331047993923540,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
                                                                3⤵
                                                                  PID:5232
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17686737875970525266,8281946719785673450,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
                                                                  3⤵
                                                                    PID:4916
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,581126461215630477,13461091367765671736,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
                                                                    3⤵
                                                                      PID:1320
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,1555319004703807642,18124938122743830614,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
                                                                      3⤵
                                                                        PID:5792
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2298197283127486183,3127757483003554150,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
                                                                        3⤵
                                                                          PID:1540
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16712057421350052534,4102998302628852386,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
                                                                          3⤵
                                                                            PID:5276
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4892,i,15303806751775959056,13502586848937628020,262144 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:8
                                                                            3⤵
                                                                              PID:5476
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,9067046934693256340,10474207804982688366,524288 --field-trial-handle=2292,i,3224202376078774222,4518373575923018530,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
                                                                              3⤵
                                                                                PID:4328
                                                                            • C:\Windows\explorer.exe
                                                                              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                              2⤵
                                                                                PID:4876
                                                                            • C:\Windows\explorer.exe
                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                              1⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2824
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                2⤵
                                                                                  PID:1808
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:3248

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v16

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      DouTuDaShi.exe
                                                                                      • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                      • Size 1.1MB
                                                                                      • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3288_1163903770\manifest.json
                                                                                      • Size 160B
                                                                                      • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3288_1326647574\manifest.json
                                                                                      • Size 43B
                                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3288_2085646037\manifest.json
                                                                                      • Size 135B
                                                                                      • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      manifest.json
                                                                                      • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3288_225144912\manifest.json
                                                                                      • Size 160B
                                                                                      • SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
                                                                                      • Size 2KB
                                                                                      • SHA256 255533f0f74d9216ce9448eb5755de95ebd329ab08ecddb0da367674ba111872
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      blocklist
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                      • Size 105KB
                                                                                      • SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      protocols.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                      • Size 3KB
                                                                                      • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      settings.dat
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      settings.dat
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      BookmarkMergedSurfaceOrdering
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                      • Size 6B
                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 4KB
                                                                                      • SHA256 5f0c160e674f7ec2d9909310b92430e224d3591c54ceaf61120ca3c5ceb36d6e
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      the-real-index
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 4KB
                                                                                      • SHA256 7d1b2432a28e06856322d6be9f2a62bb3c064b67b4b65d4ccb720c7ff986d0fc
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      the-real-index~RFe58b11b.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b11b.TMP
                                                                                      • Size 3KB
                                                                                      • SHA256 adade0210c4d9cfda7ede1213bdf1aa116add6310634364fe749cf49f09e47e7
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      SiteList-Enterprise.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                      • Size 2B
                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Edge Profile.ico
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                      • Size 70KB
                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      HubApps
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                      • Size 106KB
                                                                                      • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Network Persistent State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 6KB
                                                                                      • SHA256 79eeb5eb11244344752290ab97faacfb8b5bdb33fda9c60c01820498d7aa9ebc
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Network Persistent State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 111B
                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      SCT Auditing Pending Reports
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      • Size 2B
                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 14KB
                                                                                      • SHA256 955b6cefde6e8c1ba988543b9c1d271bfce8049d4ee50f285098e0299a9809ba
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 15KB
                                                                                      • SHA256 8a4c32064a28341f69c562b776b59b5b04d59774696b9fb2fb2c6279dad1ebd9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Secure Preferences
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                      • Size 35KB
                                                                                      • SHA256 54c5b1cb40f1383044735f34082cb8913649dd6b4860c102bc67ba14ceb9c9dd
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      sync_diagnostic.log
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                      • Size 6KB
                                                                                      • SHA256 5d83950e3771b115240e638b4e817066f30c6eb0acd9880a83a07cd63ceab6a3
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      CURRENT
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                      • Size 16B
                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      MANIFEST-000001
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                      • Size 41B
                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      OperationConfig
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                      • Size 22KB
                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      OperationConfig~RFe591a54.TMP
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591a54.TMP
                                                                                      • Size 3KB
                                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      office_endpoints_list.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                      • Size 3KB
                                                                                      • SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 18KB
                                                                                      • SHA256 5804a3dd8be63382a52910d8279d38a497bb9fce329656421d823b370f5d83c6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 18KB
                                                                                      • SHA256 cc1f16f7b53a8484f068800eb554045be190fc18aa8deee3b4abd8b4a543b255
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 02af20fbeb91f78389b37307e2ea7c177e5c58acc66f70daeddd153bfd5fc752
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 28KB
                                                                                      • SHA256 2050a3f4ccd46b54a594817abbc5ee2feac7984eab978be8d034bce6a5218e14
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      Local State
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 796c380f0817868ec39b236e1cd4b25c808c3878cf7a2e84a74e8b297a2fca2b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      nav_config.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                      • Size 2KB
                                                                                      • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      1a787d49-3e23-4cba-83dc-728963e68c6d.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1a787d49-3e23-4cba-83dc-728963e68c6d.tmp
                                                                                      • Size 132B
                                                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 252B
                                                                                      • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      metadata.json
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                      • Size 372B
                                                                                      • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      b418f942-1bd6-4afd-871c-61785736f7a0.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b418f942-1bd6-4afd-871c-61785736f7a0.tmp
                                                                                      • Size 13B
                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      hao.360[1].xml
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HNX15PTL\hao.360[1].xml
                                                                                      • Size 52KB
                                                                                      • SHA256 e7687967d3703a4f694296129dce346d59b0dd785c15c46d2eaa51b263f78a1f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      hao.360[1].xml
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HNX15PTL\hao.360[1].xml
                                                                                      • Size 2KB
                                                                                      • SHA256 0f0d0eb0dce2ab4306feb887d7de5978f6135414406fc9c1f9e9fd0e7afc927c
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                      • Size 2KB
                                                                                      • SHA256 6aeeccb5ad3a545c5e1747750ef4bbc38a6144237bb367a6394ba26795e088ca
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      sed_api_weather_info[1].htm
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K0V9WIP6\sed_api_weather_info[1].htm
                                                                                      • Size 8KB
                                                                                      • SHA256 69c3ff8836d1d2f627c702426e3795d2865ae19284817347271c239802b215ac
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      time[1].js
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K0V9WIP6\time[1].js
                                                                                      • Size 27B
                                                                                      • SHA256 7dc401d36f405ff3bfd2c5ed289788188d27123fa182d0ec7a41fe5d1d67e9cb
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      113[1].js
                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M5C5LBMC\113[1].js
                                                                                      • Size 61KB
                                                                                      • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      7dbc3df8-541b-4528-9e8c-56aad6f50e72.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7dbc3df8-541b-4528-9e8c-56aad6f50e72.tmp
                                                                                      • Size 1B
                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      cdbe83c2-6a51-44b6-991c-103fffc183d8.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cdbe83c2-6a51-44b6-991c-103fffc183d8.tmp
                                                                                      • Size 10KB
                                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      ldsajdklsajdlkjsalkda.bat
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                      • Size 589B
                                                                                      • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                      Submit Download

                                                                                      okftor.exe
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\okftor.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 2945155e1690e3f56c26cff58045204108a775a4e79a79d72d1e09a5ab25424c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      2759cd50-5de5-4135-93ba-24964e0d8ebd.tmp
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3288_670454052\2759cd50-5de5-4135-93ba-24964e0d8ebd.tmp
                                                                                      • Size 147KB
                                                                                      • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      content_new.js
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3288_771981421\CRX_INSTALL\content_new.js
                                                                                      • Size 10KB
                                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      035855.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\035855.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 942b75c5da471c30890f7e216aea937cc058faf4b2a1c9a238983c2930848129
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      039058.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\039058.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 b98517deb26fdb6ec8e0ac9c47ea9cc0609cc1e18680bfd92625ce3278c68f62
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      167288.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\167288.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 502a76fc8b1399f3e5d70186cb5147b9b51198cd04890aa408b2e6e2df8443c7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      225088.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\225088.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 03f1eff67174ac689f4fe761201e3ec67c9fd7ef9d0daf8990800c353b854dca
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      240362.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\240362.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 18552aa595acc0b47d2acb5299790bfb515a8b124d4d3217f0660c96abf5909c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      529972.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\529972.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 00b16450e841c11d98d2f9c512085797188f49d1ffe3fe85e8056e62ba31638d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      642040.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\642040.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 decb3048123d6d0610707b868af467358d8fd931f83724aaf0d8702692cefc45
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      729516.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\729516.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 1b18b6f05c2d7a6a7d23629eefc5ada7911fd5f5e505d89197026908f9a940bd
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      763574.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\763574.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 dfd2868ba50f1a1d59239ce98bd502af152bf2d3e4823ae1910f724b985b5759
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      817482.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\817482.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 b9ca35eb64ec3683f332561ec195af729061bf7cbba02dfabe9658ad95581698
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      859748.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\859748.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 c047e6a675978c17ef5e6a85932ff60d34820924f2ab3d91ee6378815f9049a2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      883597.exe
                                                                                      • Path C:\Users\Admin\AppData\Roaming\Download\883597.exe
                                                                                      • Size 1.5MB
                                                                                      • SHA256 bc583edb8ba1e71f1d116f49f64c235ad38e47ac8033e8f401f67cd91264d567
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                      Submit Download

                                                                                      memory/216-1445-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
                                                                                      Download

                                                                                      memory/624-1281-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                      Download

                                                                                      memory/696-62-0x0000000000940000-0x00000000009FF000-memory.dmp
                                                                                      Download

                                                                                      memory/740-165-0x0000000000920000-0x00000000009DF000-memory.dmp
                                                                                      Download

                                                                                      memory/1380-63-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                      Download

                                                                                      memory/1968-1115-0x0000000000850000-0x000000000090F000-memory.dmp
                                                                                      Download

                                                                                      memory/2384-1341-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
                                                                                      Download

                                                                                      memory/2636-1264-0x00000000009D0000-0x0000000000A8F000-memory.dmp
                                                                                      Download

                                                                                      memory/2696-22-0x00000000006B0000-0x000000000076F000-memory.dmp
                                                                                      Download

                                                                                      memory/2804-1342-0x00000000006B0000-0x000000000076F000-memory.dmp
                                                                                      Download

                                                                                      memory/2892-1184-0x0000000000900000-0x00000000009BF000-memory.dmp
                                                                                      Download

                                                                                      memory/3248-112-0x000002A2A8400000-0x000002A2A85A1000-memory.dmp
                                                                                      Download

                                                                                      memory/3464-163-0x0000000000A90000-0x0000000000B4F000-memory.dmp
                                                                                      Download

                                                                                      memory/3572-1064-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                      Download

                                                                                      memory/3828-1116-0x0000000000920000-0x00000000009DF000-memory.dmp
                                                                                      Download

                                                                                      memory/3944-1280-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-790-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-791-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1267-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1181-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1098-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1099-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1327-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                      Download

                                                                                      memory/4092-1326-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/4136-1183-0x00000000009B0000-0x0000000000A6F000-memory.dmp
                                                                                      Download

                                                                                      memory/4164-1324-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/4164-1458-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/4164-608-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/4164-1089-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/4164-977-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/4184-1300-0x0000000000A40000-0x0000000000AFF000-memory.dmp
                                                                                      Download

                                                                                      memory/4292-39-0x00000000009A0000-0x0000000000A5F000-memory.dmp
                                                                                      Download

                                                                                      memory/4348-1299-0x0000000000920000-0x00000000009DF000-memory.dmp
                                                                                      Download

                                                                                      memory/4660-1201-0x0000000000920000-0x00000000009DF000-memory.dmp
                                                                                      Download

                                                                                      memory/4752-813-0x0000000000960000-0x0000000000A1F000-memory.dmp
                                                                                      Download

                                                                                      memory/4900-1236-0x0000000000980000-0x0000000000A3F000-memory.dmp
                                                                                      Download

                                                                                      memory/4992-38-0x0000000000970000-0x0000000000A2F000-memory.dmp
                                                                                      Download

                                                                                      memory/5012-336-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                      Download

                                                                                      memory/5012-337-0x0000000000B80000-0x0000000000C3F000-memory.dmp
                                                                                      Download

                                                                                      memory/5012-338-0x0000000002EB0000-0x0000000002F0E000-memory.dmp
                                                                                      Download

                                                                                      memory/5012-1448-0x0000000000B80000-0x0000000000C3F000-memory.dmp
                                                                                      Download

                                                                                      memory/5152-814-0x0000000000A30000-0x0000000000AEF000-memory.dmp
                                                                                      Download

                                                                                      memory/5212-564-0x0000000000940000-0x00000000009FF000-memory.dmp
                                                                                      Download

                                                                                      memory/5232-1265-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                      Download

                                                                                      memory/5304-1138-0x00000000006D0000-0x000000000078F000-memory.dmp
                                                                                      Download

                                                                                      memory/5336-1446-0x0000000000900000-0x00000000009BF000-memory.dmp
                                                                                      Download

                                                                                      memory/5352-965-0x00000000009A0000-0x0000000000A5F000-memory.dmp
                                                                                      Download

                                                                                      memory/5376-1151-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                      Download

                                                                                      memory/5380-1321-0x00000000008D0000-0x000000000098F000-memory.dmp
                                                                                      Download

                                                                                      memory/5412-1083-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/5480-1320-0x0000000000900000-0x00000000009BF000-memory.dmp
                                                                                      Download

                                                                                      memory/5544-966-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
                                                                                      Download

                                                                                      memory/5572-1235-0x0000000000720000-0x00000000007DF000-memory.dmp
                                                                                      Download

                                                                                      memory/5744-577-0x0000000000910000-0x00000000009CF000-memory.dmp
                                                                                      Download

                                                                                      memory/5744-909-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                      Download

                                                                                      memory/5812-1202-0x0000000000820000-0x00000000008DF000-memory.dmp
                                                                                      Download

                                                                                      memory/5856-1137-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                      Download

                                                                                      memory/5868-1402-0x0000000000910000-0x00000000009CF000-memory.dmp
                                                                                      Download

                                                                                      memory/5932-1033-0x0000000000980000-0x0000000000A3F000-memory.dmp
                                                                                      Download

                                                                                      memory/5972-1034-0x0000000000AF0000-0x0000000000BAF000-memory.dmp
                                                                                      Download

                                                                                      memory/6008-911-0x0000000000A90000-0x0000000000B4F000-memory.dmp
                                                                                      Download

                                                                                      memory/6072-1403-0x00000000007C0000-0x000000000087F000-memory.dmp
                                                                                      Download

                                                                                      memory/6120-1062-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                      Download

                                                                                      memory/6140-1150-0x0000000000780000-0x000000000083F000-memory.dmp
                                                                                      Download