Overview

overview

7

Static

static

3

2026-08-07...op.exe

windows10-2004-x64

7

2026-08-07...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    115s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_9f6182759768b12c6fff167cf1a4428a_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260807-vst3maszft
  • SHA256 281b96e20024708a7af01b269ae1c177565bfce6c1844ba501e9ef563a9eff4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_9f6182759768b12c6fff167cf1a4428a_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_9f6182759768b12c6fff167cf1a4428a_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3356
    • C:\Users\Admin\AppData\Local\Temp\zeqntz.exe
      "C:\Users\Admin\AppData\Local\Temp\zeqntz.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5600
      • C:\Users\Admin\AppData\Local\Temp\zeqntz.exe
        "C:\Users\Admin\AppData\Local\Temp\zeqntz.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Roaming\Download\514808.exe
          "C:\Users\Admin\AppData\Roaming\Download\514808.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Users\Admin\AppData\Roaming\Download\514808.exe
            "C:\Users\Admin\AppData\Roaming\Download\514808.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2864
        • C:\Users\Admin\AppData\Roaming\Download\868279.exe
          "C:\Users\Admin\AppData\Roaming\Download\868279.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Users\Admin\AppData\Roaming\Download\868279.exe
            "C:\Users\Admin\AppData\Roaming\Download\868279.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:236
        • C:\Users\Admin\AppData\Roaming\Download\258881.exe
          "C:\Users\Admin\AppData\Roaming\Download\258881.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Users\Admin\AppData\Roaming\Download\258881.exe
            "C:\Users\Admin\AppData\Roaming\Download\258881.exe"
            5⤵
            • Executes dropped EXE
            PID:3368
        • C:\Users\Admin\AppData\Roaming\Download\797780.exe
          "C:\Users\Admin\AppData\Roaming\Download\797780.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5172
          • C:\Users\Admin\AppData\Roaming\Download\797780.exe
            "C:\Users\Admin\AppData\Roaming\Download\797780.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:468
        • C:\Users\Admin\AppData\Roaming\Download\567667.exe
          "C:\Users\Admin\AppData\Roaming\Download\567667.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Users\Admin\AppData\Roaming\Download\567667.exe
            "C:\Users\Admin\AppData\Roaming\Download\567667.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4432
        • C:\Users\Admin\AppData\Roaming\Download\958361.exe
          "C:\Users\Admin\AppData\Roaming\Download\958361.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Users\Admin\AppData\Roaming\Download\958361.exe
            "C:\Users\Admin\AppData\Roaming\Download\958361.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3696
        • C:\Users\Admin\AppData\Roaming\Download\417159.exe
          "C:\Users\Admin\AppData\Roaming\Download\417159.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\Users\Admin\AppData\Roaming\Download\417159.exe
            "C:\Users\Admin\AppData\Roaming\Download\417159.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4796
        • C:\Users\Admin\AppData\Roaming\Download\787073.exe
          "C:\Users\Admin\AppData\Roaming\Download\787073.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3824
          • C:\Users\Admin\AppData\Roaming\Download\787073.exe
            "C:\Users\Admin\AppData\Roaming\Download\787073.exe"
            5⤵
            • Executes dropped EXE
            PID:4696
        • C:\Users\Admin\AppData\Roaming\Download\044872.exe
          "C:\Users\Admin\AppData\Roaming\Download\044872.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Users\Admin\AppData\Roaming\Download\044872.exe
            "C:\Users\Admin\AppData\Roaming\Download\044872.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6140
        • C:\Users\Admin\AppData\Roaming\Download\680216.exe
          "C:\Users\Admin\AppData\Roaming\Download\680216.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5700
          • C:\Users\Admin\AppData\Roaming\Download\680216.exe
            "C:\Users\Admin\AppData\Roaming\Download\680216.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3044
        • C:\Users\Admin\AppData\Roaming\Download\373527.exe
          "C:\Users\Admin\AppData\Roaming\Download\373527.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6088
          • C:\Users\Admin\AppData\Roaming\Download\373527.exe
            "C:\Users\Admin\AppData\Roaming\Download\373527.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3068
        • C:\Users\Admin\AppData\Roaming\Download\533424.exe
          "C:\Users\Admin\AppData\Roaming\Download\533424.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5536
          • C:\Users\Admin\AppData\Roaming\Download\533424.exe
            "C:\Users\Admin\AppData\Roaming\Download\533424.exe"
            5⤵
            • Executes dropped EXE
            PID:4544
        • C:\Users\Admin\AppData\Roaming\Download\402583.exe
          "C:\Users\Admin\AppData\Roaming\Download\402583.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5664
          • C:\Users\Admin\AppData\Roaming\Download\402583.exe
            "C:\Users\Admin\AppData\Roaming\Download\402583.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:240
        • C:\Users\Admin\AppData\Roaming\Download\349544.exe
          "C:\Users\Admin\AppData\Roaming\Download\349544.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4840
          • C:\Users\Admin\AppData\Roaming\Download\349544.exe
            "C:\Users\Admin\AppData\Roaming\Download\349544.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5012
        • C:\Users\Admin\AppData\Roaming\Download\433911.exe
          "C:\Users\Admin\AppData\Roaming\Download\433911.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:808
          • C:\Users\Admin\AppData\Roaming\Download\433911.exe
            "C:\Users\Admin\AppData\Roaming\Download\433911.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5000
        • C:\Users\Admin\AppData\Roaming\Download\102952.exe
          "C:\Users\Admin\AppData\Roaming\Download\102952.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5928
          • C:\Users\Admin\AppData\Roaming\Download\102952.exe
            "C:\Users\Admin\AppData\Roaming\Download\102952.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1888
        • C:\Users\Admin\AppData\Roaming\Download\551051.exe
          "C:\Users\Admin\AppData\Roaming\Download\551051.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3004
          • C:\Users\Admin\AppData\Roaming\Download\551051.exe
            "C:\Users\Admin\AppData\Roaming\Download\551051.exe"
            5⤵
            • Executes dropped EXE
            PID:4900
        • C:\Users\Admin\AppData\Roaming\Download\787931.exe
          "C:\Users\Admin\AppData\Roaming\Download\787931.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2456
          • C:\Users\Admin\AppData\Roaming\Download\787931.exe
            "C:\Users\Admin\AppData\Roaming\Download\787931.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2216
        • C:\Users\Admin\AppData\Roaming\Download\320377.exe
          "C:\Users\Admin\AppData\Roaming\Download\320377.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4860
          • C:\Users\Admin\AppData\Roaming\Download\320377.exe
            "C:\Users\Admin\AppData\Roaming\Download\320377.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6048
        • C:\Users\Admin\AppData\Roaming\Download\789157.exe
          "C:\Users\Admin\AppData\Roaming\Download\789157.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3036
          • C:\Users\Admin\AppData\Roaming\Download\789157.exe
            "C:\Users\Admin\AppData\Roaming\Download\789157.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3456
        • C:\Users\Admin\AppData\Roaming\Download\170879.exe
          "C:\Users\Admin\AppData\Roaming\Download\170879.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1108
          • C:\Users\Admin\AppData\Roaming\Download\170879.exe
            "C:\Users\Admin\AppData\Roaming\Download\170879.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3856
        • C:\Users\Admin\AppData\Roaming\Download\673400.exe
          "C:\Users\Admin\AppData\Roaming\Download\673400.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1380
          • C:\Users\Admin\AppData\Roaming\Download\673400.exe
            "C:\Users\Admin\AppData\Roaming\Download\673400.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4928
        • C:\Users\Admin\AppData\Roaming\Download\103520.exe
          "C:\Users\Admin\AppData\Roaming\Download\103520.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3372
          • C:\Users\Admin\AppData\Roaming\Download\103520.exe
            "C:\Users\Admin\AppData\Roaming\Download\103520.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4320
        • C:\Users\Admin\AppData\Roaming\Download\606161.exe
          "C:\Users\Admin\AppData\Roaming\Download\606161.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2752
          • C:\Users\Admin\AppData\Roaming\Download\606161.exe
            "C:\Users\Admin\AppData\Roaming\Download\606161.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1892
        • C:\Users\Admin\AppData\Roaming\Download\956938.exe
          "C:\Users\Admin\AppData\Roaming\Download\956938.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4284
          • C:\Users\Admin\AppData\Roaming\Download\956938.exe
            "C:\Users\Admin\AppData\Roaming\Download\956938.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4524
        • C:\Users\Admin\AppData\Roaming\Download\591384.exe
          "C:\Users\Admin\AppData\Roaming\Download\591384.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5824
          • C:\Users\Admin\AppData\Roaming\Download\591384.exe
            "C:\Users\Admin\AppData\Roaming\Download\591384.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:724
        • C:\Users\Admin\AppData\Roaming\Download\151097.exe
          "C:\Users\Admin\AppData\Roaming\Download\151097.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5832
          • C:\Users\Admin\AppData\Roaming\Download\151097.exe
            "C:\Users\Admin\AppData\Roaming\Download\151097.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4320
        • C:\Users\Admin\AppData\Roaming\Download\442712.exe
          "C:\Users\Admin\AppData\Roaming\Download\442712.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:264
          • C:\Users\Admin\AppData\Roaming\Download\442712.exe
            "C:\Users\Admin\AppData\Roaming\Download\442712.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6100
        • C:\Users\Admin\AppData\Roaming\Download\701591.exe
          "C:\Users\Admin\AppData\Roaming\Download\701591.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1972
          • C:\Users\Admin\AppData\Roaming\Download\701591.exe
            "C:\Users\Admin\AppData\Roaming\Download\701591.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5260
        • C:\Users\Admin\AppData\Roaming\Download\546935.exe
          "C:\Users\Admin\AppData\Roaming\Download\546935.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6076
          • C:\Users\Admin\AppData\Roaming\Download\546935.exe
            "C:\Users\Admin\AppData\Roaming\Download\546935.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2424
        • C:\Users\Admin\AppData\Roaming\Download\893734.exe
          "C:\Users\Admin\AppData\Roaming\Download\893734.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4064
          • C:\Users\Admin\AppData\Roaming\Download\893734.exe
            "C:\Users\Admin\AppData\Roaming\Download\893734.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1636
        • C:\Users\Admin\AppData\Roaming\Download\645891.exe
          "C:\Users\Admin\AppData\Roaming\Download\645891.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4868
          • C:\Users\Admin\AppData\Roaming\Download\645891.exe
            "C:\Users\Admin\AppData\Roaming\Download\645891.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4476
        • C:\Users\Admin\AppData\Roaming\Download\235505.exe
          "C:\Users\Admin\AppData\Roaming\Download\235505.exe" /Shorttailedrestart
          4⤵
            PID:3048
            • C:\Users\Admin\AppData\Roaming\Download\235505.exe
              "C:\Users\Admin\AppData\Roaming\Download\235505.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2112
          • C:\Users\Admin\AppData\Roaming\Download\634210.exe
            "C:\Users\Admin\AppData\Roaming\Download\634210.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4192
            • C:\Users\Admin\AppData\Roaming\Download\634210.exe
              "C:\Users\Admin\AppData\Roaming\Download\634210.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3360
          • C:\Users\Admin\AppData\Roaming\Download\628385.exe
            "C:\Users\Admin\AppData\Roaming\Download\628385.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5088
            • C:\Users\Admin\AppData\Roaming\Download\628385.exe
              "C:\Users\Admin\AppData\Roaming\Download\628385.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4748
          • C:\Users\Admin\AppData\Roaming\Download\201522.exe
            "C:\Users\Admin\AppData\Roaming\Download\201522.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:720
            • C:\Users\Admin\AppData\Roaming\Download\201522.exe
              "C:\Users\Admin\AppData\Roaming\Download\201522.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1780
          • C:\Users\Admin\AppData\Roaming\Download\673246.exe
            "C:\Users\Admin\AppData\Roaming\Download\673246.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2708
            • C:\Users\Admin\AppData\Roaming\Download\673246.exe
              "C:\Users\Admin\AppData\Roaming\Download\673246.exe"
              5⤵
                PID:3588
            • C:\Users\Admin\AppData\Roaming\Download\207462.exe
              "C:\Users\Admin\AppData\Roaming\Download\207462.exe" /Shorttailedrestart
              4⤵
                PID:6064
                • C:\Users\Admin\AppData\Roaming\Download\207462.exe
                  "C:\Users\Admin\AppData\Roaming\Download\207462.exe"
                  5⤵
                    PID:4124
                • C:\Users\Admin\AppData\Roaming\Download\014817.exe
                  "C:\Users\Admin\AppData\Roaming\Download\014817.exe" /Shorttailedrestart
                  4⤵
                    PID:3348
                    • C:\Users\Admin\AppData\Roaming\Download\014817.exe
                      "C:\Users\Admin\AppData\Roaming\Download\014817.exe"
                      5⤵
                        PID:4884
                    • C:\Users\Admin\AppData\Roaming\Download\548064.exe
                      "C:\Users\Admin\AppData\Roaming\Download\548064.exe" /Shorttailedrestart
                      4⤵
                        PID:3044
                        • C:\Users\Admin\AppData\Roaming\Download\548064.exe
                          "C:\Users\Admin\AppData\Roaming\Download\548064.exe"
                          5⤵
                            PID:3556
                        • C:\Users\Admin\AppData\Roaming\Download\847778.exe
                          "C:\Users\Admin\AppData\Roaming\Download\847778.exe" /Shorttailedrestart
                          4⤵
                            PID:5704
                            • C:\Users\Admin\AppData\Roaming\Download\847778.exe
                              "C:\Users\Admin\AppData\Roaming\Download\847778.exe"
                              5⤵
                                PID:3112
                            • C:\Users\Admin\AppData\Roaming\Download\341089.exe
                              "C:\Users\Admin\AppData\Roaming\Download\341089.exe" /Shorttailedrestart
                              4⤵
                                PID:2904
                                • C:\Users\Admin\AppData\Roaming\Download\341089.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\341089.exe"
                                  5⤵
                                    PID:4556
                                • C:\Users\Admin\AppData\Roaming\Download\786260.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\786260.exe" /Shorttailedrestart
                                  4⤵
                                    PID:300
                                    • C:\Users\Admin\AppData\Roaming\Download\786260.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\786260.exe"
                                      5⤵
                                        PID:4700
                                    • C:\Users\Admin\AppData\Roaming\Download\280891.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\280891.exe" /Shorttailedrestart
                                      4⤵
                                        PID:296
                                        • C:\Users\Admin\AppData\Roaming\Download\280891.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\280891.exe"
                                          5⤵
                                            PID:1812
                                        • C:\Users\Admin\AppData\Roaming\Download\449678.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\449678.exe" /Shorttailedrestart
                                          4⤵
                                            PID:1140
                                            • C:\Users\Admin\AppData\Roaming\Download\449678.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\449678.exe"
                                              5⤵
                                                PID:2588
                                            • C:\Users\Admin\AppData\Roaming\Download\010392.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\010392.exe" /Shorttailedrestart
                                              4⤵
                                                PID:2112
                                                • C:\Users\Admin\AppData\Roaming\Download\010392.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\010392.exe"
                                                  5⤵
                                                    PID:4436
                                                • C:\Users\Admin\AppData\Roaming\Download\512823.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\512823.exe" /Shorttailedrestart
                                                  4⤵
                                                    PID:2916
                                                    • C:\Users\Admin\AppData\Roaming\Download\512823.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\512823.exe"
                                                      5⤵
                                                        PID:5416
                                                    • C:\Users\Admin\AppData\Roaming\Download\015452.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\015452.exe" /Shorttailedrestart
                                                      4⤵
                                                        PID:1940
                                                        • C:\Users\Admin\AppData\Roaming\Download\015452.exe
                                                          "C:\Users\Admin\AppData\Roaming\Download\015452.exe"
                                                          5⤵
                                                            PID:4168
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                                      2⤵
                                                      • Drops file in Windows directory
                                                      • Enumerates system info in registry
                                                      • Modifies data under HKEY_USERS
                                                      • Modifies registry class
                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4880
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffcf597c188,0x7ffcf597c194,0x7ffcf597c1a0
                                                        3⤵
                                                          PID:3864
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,17900360088468466604,229822945081642191,262144 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
                                                          3⤵
                                                            PID:5392
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,15281081405777510264,4477494209120320151,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:2972
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,14311653779313390164,13271967817637426926,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
                                                            3⤵
                                                              PID:2568
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,15025142388865471446,14957744759969916467,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
                                                              3⤵
                                                                PID:1672
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,14211303787847055639,15205116762741909693,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
                                                                3⤵
                                                                  PID:4440
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4223315868307553150,11303908395931712525,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
                                                                  3⤵
                                                                    PID:1800
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8361108164086329350,1902089180516756520,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
                                                                    3⤵
                                                                      PID:2112
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5390298260847647170,1777101709114170432,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                                                                      3⤵
                                                                        PID:1108
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,14502582855198675025,6732323047953205049,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
                                                                        3⤵
                                                                          PID:5944
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,44089361987785360,3882499131169006023,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
                                                                          3⤵
                                                                            PID:5356
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12279986964324049071,107091958825793478,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                                                            3⤵
                                                                              PID:5172
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12279986964324049071,107091958825793478,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                                                              3⤵
                                                                                PID:4752
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12671867992154191107,4369259742382678665,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                                                                3⤵
                                                                                  PID:408
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17511223093913921689,4906416719930263606,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
                                                                                  3⤵
                                                                                    PID:4868
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4292,i,8523791586988219013,748629347949030056,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
                                                                                    3⤵
                                                                                      PID:4496
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,1378902074993616061,13817006752412496297,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
                                                                                      3⤵
                                                                                        PID:4788
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,9983277445916809845,6698020814167772458,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
                                                                                        3⤵
                                                                                          PID:2148
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4956,i,15694457911674589323,3438400205031606993,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
                                                                                          3⤵
                                                                                            PID:2728
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6444,i,4674762317322565449,4332368185317678940,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
                                                                                            3⤵
                                                                                              PID:4864
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10076739015034323015,5672469966801170929,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                                                                              3⤵
                                                                                                PID:2384
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12638823939913373486,13193699096128178032,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:5012
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9071549379504924565,16630950480051885605,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:6040
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8969090401159036488,13879224580669466343,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                                                                    3⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:5044
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,530587348299241287,2364851554071721225,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:12
                                                                                                    3⤵
                                                                                                      PID:2012
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2644,i,17091004572534743465,8069057048541976667,2097152 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:5008
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,15091819610348064991,13289061042747667423,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
                                                                                                        3⤵
                                                                                                          PID:3168
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,10221335279332182454,8313320702464331796,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:2880
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,5177801357256599807,14781797109602544087,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:4500
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6608,i,5933494572032105821,8772536578931190371,262144 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:10
                                                                                                              3⤵
                                                                                                                PID:3868
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11701976029322787957,12581449890316034305,524288 --field-trial-handle=2796,i,2718433316072852933,1084627569536862471,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:4336
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                2⤵
                                                                                                                  PID:3064
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                1⤵
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2820
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:4724
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:5764
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                  1⤵
                                                                                                                    PID:4432
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                    1⤵
                                                                                                                      PID:240

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          DouTuDaShi.exe
                                                                                                                          • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                                          • Size 1.1MB
                                                                                                                          • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                          • Size 6B
                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 8cb26c689c22196fcf0dc8a50bd8683142a36ad06e616f316f6d7c7d4f754f11
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 924007395aeea0d566db0b24a7bea29af898d68b9f868adc7b522f78b63bc35b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SiteList-Enterprise.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Edge Profile.ico
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                          • Size 70KB
                                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 817c9bb4db28bc777d32067e22afa7a0ec2d52ca2047bb01ac12ccc5c9a243e9
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Sdch Dictionaries
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                          • Size 40B
                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 11KB
                                                                                                                          • SHA256 e6693d942bc9ddc0ec6e93c553b2342871be444c742690833d2cc8827a735b0d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 11KB
                                                                                                                          • SHA256 c2ae63cb8ecbf5a1de4e5b6b6427961e4b8db9f42550b498c43efd2069923840
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 13KB
                                                                                                                          • SHA256 095ceaccc093b48e873759120c82c6ea2cfd9c82a4781252a503d61a4549cd82
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Secure Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                          • Size 27KB
                                                                                                                          • SHA256 219493e862704c649d3574d601788ee6351be155990a612c637d5ecbf7180302
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sync_diagnostic.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                          • Size 4KB
                                                                                                                          • SHA256 edd5add8f2201e9efe592afd7ee9a7f8234fedcbda1f48c60cf23d62a7d567d0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          81a4bdef-9325-4eef-a3e2-b70646cd930b.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\81a4bdef-9325-4eef-a3e2-b70646cd930b.tmp
                                                                                                                          • Size 22KB
                                                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 44KB
                                                                                                                          • SHA256 bdbb9514a55b2bd0a31ddd789acc8ed702353716b03f36b0accb0c6d93965374
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 35KB
                                                                                                                          • SHA256 59fc584beddd0995cfab0e1351b3b513c02800eaa3abfec722f92a3409fb3b1f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 35KB
                                                                                                                          • SHA256 8d53f4aa6add23d068658fa361d3e4338ead68728ad5748a6a59fb6c4493c114
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 38KB
                                                                                                                          • SHA256 ce6eef36809fefdb15ca9b61a8276ca0dea22c9dfd4d5ebb93f7c5f83a15c851
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 252B
                                                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 132B
                                                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                          • Size 153KB
                                                                                                                          • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                          • Size 13B
                                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                          • Size 132B
                                                                                                                          • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          f42643c8-f804-4ea6-a248-1110ed7502fa.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\f42643c8-f804-4ea6-a248-1110ed7502fa.tmp
                                                                                                                          • Size 1B
                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          ldsajdklsajdlkjsalkda.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                          • Size 589B
                                                                                                                          • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          content_new.js
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4880_1981676877\CRX_INSTALL\content_new.js
                                                                                                                          • Size 10KB
                                                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          zeqntz.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\zeqntz.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 281b96e20024708a7af01b269ae1c177565bfce6c1844ba501e9ef563a9eff4a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          044872.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\044872.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 f8952ac65ead982b20f83f08f363241f1d0ab19d6d481e49ecdd6777a3f85c00
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          258881.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\258881.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 71a53edc8fe76caa9f398f6a3e9e718d511da0843a7a7345c0408680fbd1a894
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          373527.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\373527.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 1f834978360bc335072505c95e08740d06e991fb127edb85312cdf528444a10b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          417159.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\417159.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 f24ba3a1406930ecb6425d48b8eeca21fab4aaa9b6131c8fc77486b93fa0f2ad
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          514808.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\514808.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 08fff24793dc9f7c9750ae96c96740ca6d43adbb2671cb4a5e98b36c14dfad8d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          533424.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\533424.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 e2c4b5e3aed10fbd35875e9092259cea52900fe3c837d0048e0ebd423cbb7526
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          567667.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\567667.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 44d36a3a94454fd735a033b3bb50abab72fa993ff19a088e2c1fa2333ffbeb07
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          680216.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\680216.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 76704553bacf154fa9faa3a3dfc15f3e759aa221a2adf68c8fa62c8fd202ab5b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          787073.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\787073.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 d1a84957158c9d8c20d2bdbd4755968feb9b65440f34117cdc9e9a5ed6dde4c3
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          797780.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\797780.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 55074c4e9281e310224a503bdc785d098e17eb20dc4c3c6d0b86707b46997c86
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          868279.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\868279.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 753905b6637a10aab1a371a91e95bf03d196f4a4741e19f9a260bbea3c6b1a6c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          958361.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\958361.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 eba0eb825fe327ca08ca807189424733df5b4a68e4dbf8a409e33eb241b6659b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/1752-590-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-960-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-904-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1009-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1055-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1093-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1129-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-307-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1175-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-1204-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2420-114-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download