Overview

overview

7

Static

static

3

2026-08-08...op.exe

windows10-2004-x64

7

2026-08-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 06:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_7c285ff815643d78c9b5edfe2373fb50_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260808-g9vtlavyf1
  • SHA256 dd1f3232d52739c323fa87cfc0d5aad465e1883fcdd108846cb34f5c788b9afe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_7c285ff815643d78c9b5edfe2373fb50_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7c285ff815643d78c9b5edfe2373fb50_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3728
    • C:\Users\Admin\AppData\Local\Temp\ygdyef.exe
      "C:\Users\Admin\AppData\Local\Temp\ygdyef.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Users\Admin\AppData\Local\Temp\ygdyef.exe
        "C:\Users\Admin\AppData\Local\Temp\ygdyef.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Users\Admin\AppData\Roaming\Download\056168.exe
          "C:\Users\Admin\AppData\Roaming\Download\056168.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6092
          • C:\Users\Admin\AppData\Roaming\Download\056168.exe
            "C:\Users\Admin\AppData\Roaming\Download\056168.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5384
        • C:\Users\Admin\AppData\Roaming\Download\950658.exe
          "C:\Users\Admin\AppData\Roaming\Download\950658.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Users\Admin\AppData\Roaming\Download\950658.exe
            "C:\Users\Admin\AppData\Roaming\Download\950658.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3232
        • C:\Users\Admin\AppData\Roaming\Download\664189.exe
          "C:\Users\Admin\AppData\Roaming\Download\664189.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\Users\Admin\AppData\Roaming\Download\664189.exe
            "C:\Users\Admin\AppData\Roaming\Download\664189.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2360
        • C:\Users\Admin\AppData\Roaming\Download\423146.exe
          "C:\Users\Admin\AppData\Roaming\Download\423146.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Users\Admin\AppData\Roaming\Download\423146.exe
            "C:\Users\Admin\AppData\Roaming\Download\423146.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3320
        • C:\Users\Admin\AppData\Roaming\Download\927675.exe
          "C:\Users\Admin\AppData\Roaming\Download\927675.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1268
          • C:\Users\Admin\AppData\Roaming\Download\927675.exe
            "C:\Users\Admin\AppData\Roaming\Download\927675.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:200
        • C:\Users\Admin\AppData\Roaming\Download\476474.exe
          "C:\Users\Admin\AppData\Roaming\Download\476474.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2476
          • C:\Users\Admin\AppData\Roaming\Download\476474.exe
            "C:\Users\Admin\AppData\Roaming\Download\476474.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2764
        • C:\Users\Admin\AppData\Roaming\Download\765188.exe
          "C:\Users\Admin\AppData\Roaming\Download\765188.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Users\Admin\AppData\Roaming\Download\765188.exe
            "C:\Users\Admin\AppData\Roaming\Download\765188.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1672
        • C:\Users\Admin\AppData\Roaming\Download\513439.exe
          "C:\Users\Admin\AppData\Roaming\Download\513439.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4140
          • C:\Users\Admin\AppData\Roaming\Download\513439.exe
            "C:\Users\Admin\AppData\Roaming\Download\513439.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3760
        • C:\Users\Admin\AppData\Roaming\Download\215769.exe
          "C:\Users\Admin\AppData\Roaming\Download\215769.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:8
          • C:\Users\Admin\AppData\Roaming\Download\215769.exe
            "C:\Users\Admin\AppData\Roaming\Download\215769.exe"
            5⤵
            • Executes dropped EXE
            PID:4168
        • C:\Users\Admin\AppData\Roaming\Download\222025.exe
          "C:\Users\Admin\AppData\Roaming\Download\222025.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5720
          • C:\Users\Admin\AppData\Roaming\Download\222025.exe
            "C:\Users\Admin\AppData\Roaming\Download\222025.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2888
        • C:\Users\Admin\AppData\Roaming\Download\690729.exe
          "C:\Users\Admin\AppData\Roaming\Download\690729.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2828
          • C:\Users\Admin\AppData\Roaming\Download\690729.exe
            "C:\Users\Admin\AppData\Roaming\Download\690729.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3132
        • C:\Users\Admin\AppData\Roaming\Download\859618.exe
          "C:\Users\Admin\AppData\Roaming\Download\859618.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5984
          • C:\Users\Admin\AppData\Roaming\Download\859618.exe
            "C:\Users\Admin\AppData\Roaming\Download\859618.exe"
            5⤵
            • Executes dropped EXE
            PID:4616
        • C:\Users\Admin\AppData\Roaming\Download\543157.exe
          "C:\Users\Admin\AppData\Roaming\Download\543157.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1812
          • C:\Users\Admin\AppData\Roaming\Download\543157.exe
            "C:\Users\Admin\AppData\Roaming\Download\543157.exe"
            5⤵
            • Executes dropped EXE
            PID:4260
        • C:\Users\Admin\AppData\Roaming\Download\186593.exe
          "C:\Users\Admin\AppData\Roaming\Download\186593.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5548
          • C:\Users\Admin\AppData\Roaming\Download\186593.exe
            "C:\Users\Admin\AppData\Roaming\Download\186593.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5792
        • C:\Users\Admin\AppData\Roaming\Download\587107.exe
          "C:\Users\Admin\AppData\Roaming\Download\587107.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1276
          • C:\Users\Admin\AppData\Roaming\Download\587107.exe
            "C:\Users\Admin\AppData\Roaming\Download\587107.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4156
        • C:\Users\Admin\AppData\Roaming\Download\833188.exe
          "C:\Users\Admin\AppData\Roaming\Download\833188.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1992
          • C:\Users\Admin\AppData\Roaming\Download\833188.exe
            "C:\Users\Admin\AppData\Roaming\Download\833188.exe"
            5⤵
            • Executes dropped EXE
            PID:4072
        • C:\Users\Admin\AppData\Roaming\Download\949435.exe
          "C:\Users\Admin\AppData\Roaming\Download\949435.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1140
          • C:\Users\Admin\AppData\Roaming\Download\949435.exe
            "C:\Users\Admin\AppData\Roaming\Download\949435.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6044
        • C:\Users\Admin\AppData\Roaming\Download\459965.exe
          "C:\Users\Admin\AppData\Roaming\Download\459965.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3400
          • C:\Users\Admin\AppData\Roaming\Download\459965.exe
            "C:\Users\Admin\AppData\Roaming\Download\459965.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4108
        • C:\Users\Admin\AppData\Roaming\Download\705947.exe
          "C:\Users\Admin\AppData\Roaming\Download\705947.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4708
          • C:\Users\Admin\AppData\Roaming\Download\705947.exe
            "C:\Users\Admin\AppData\Roaming\Download\705947.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4768
        • C:\Users\Admin\AppData\Roaming\Download\719105.exe
          "C:\Users\Admin\AppData\Roaming\Download\719105.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3060
          • C:\Users\Admin\AppData\Roaming\Download\719105.exe
            "C:\Users\Admin\AppData\Roaming\Download\719105.exe"
            5⤵
            • Executes dropped EXE
            PID:5848
        • C:\Users\Admin\AppData\Roaming\Download\241634.exe
          "C:\Users\Admin\AppData\Roaming\Download\241634.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4604
          • C:\Users\Admin\AppData\Roaming\Download\241634.exe
            "C:\Users\Admin\AppData\Roaming\Download\241634.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3004
        • C:\Users\Admin\AppData\Roaming\Download\945163.exe
          "C:\Users\Admin\AppData\Roaming\Download\945163.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1584
          • C:\Users\Admin\AppData\Roaming\Download\945163.exe
            "C:\Users\Admin\AppData\Roaming\Download\945163.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4380
        • C:\Users\Admin\AppData\Roaming\Download\039410.exe
          "C:\Users\Admin\AppData\Roaming\Download\039410.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5312
          • C:\Users\Admin\AppData\Roaming\Download\039410.exe
            "C:\Users\Admin\AppData\Roaming\Download\039410.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4912
        • C:\Users\Admin\AppData\Roaming\Download\743154.exe
          "C:\Users\Admin\AppData\Roaming\Download\743154.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5716
          • C:\Users\Admin\AppData\Roaming\Download\743154.exe
            "C:\Users\Admin\AppData\Roaming\Download\743154.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5848
        • C:\Users\Admin\AppData\Roaming\Download\954846.exe
          "C:\Users\Admin\AppData\Roaming\Download\954846.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3676
          • C:\Users\Admin\AppData\Roaming\Download\954846.exe
            "C:\Users\Admin\AppData\Roaming\Download\954846.exe"
            5⤵
            • Executes dropped EXE
            PID:3148
        • C:\Users\Admin\AppData\Roaming\Download\664998.exe
          "C:\Users\Admin\AppData\Roaming\Download\664998.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4252
          • C:\Users\Admin\AppData\Roaming\Download\664998.exe
            "C:\Users\Admin\AppData\Roaming\Download\664998.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2584
        • C:\Users\Admin\AppData\Roaming\Download\166429.exe
          "C:\Users\Admin\AppData\Roaming\Download\166429.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3344
          • C:\Users\Admin\AppData\Roaming\Download\166429.exe
            "C:\Users\Admin\AppData\Roaming\Download\166429.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3792
        • C:\Users\Admin\AppData\Roaming\Download\557134.exe
          "C:\Users\Admin\AppData\Roaming\Download\557134.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6028
          • C:\Users\Admin\AppData\Roaming\Download\557134.exe
            "C:\Users\Admin\AppData\Roaming\Download\557134.exe"
            5⤵
            • Executes dropped EXE
            PID:3136
        • C:\Users\Admin\AppData\Roaming\Download\057856.exe
          "C:\Users\Admin\AppData\Roaming\Download\057856.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4228
          • C:\Users\Admin\AppData\Roaming\Download\057856.exe
            "C:\Users\Admin\AppData\Roaming\Download\057856.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4584
        • C:\Users\Admin\AppData\Roaming\Download\306825.exe
          "C:\Users\Admin\AppData\Roaming\Download\306825.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5320
          • C:\Users\Admin\AppData\Roaming\Download\306825.exe
            "C:\Users\Admin\AppData\Roaming\Download\306825.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:860
        • C:\Users\Admin\AppData\Roaming\Download\665722.exe
          "C:\Users\Admin\AppData\Roaming\Download\665722.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2844
          • C:\Users\Admin\AppData\Roaming\Download\665722.exe
            "C:\Users\Admin\AppData\Roaming\Download\665722.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5860
        • C:\Users\Admin\AppData\Roaming\Download\991605.exe
          "C:\Users\Admin\AppData\Roaming\Download\991605.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5596
          • C:\Users\Admin\AppData\Roaming\Download\991605.exe
            "C:\Users\Admin\AppData\Roaming\Download\991605.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4800
        • C:\Users\Admin\AppData\Roaming\Download\524051.exe
          "C:\Users\Admin\AppData\Roaming\Download\524051.exe" /Shorttailedrestart
          4⤵
            PID:5456
            • C:\Users\Admin\AppData\Roaming\Download\524051.exe
              "C:\Users\Admin\AppData\Roaming\Download\524051.exe"
              5⤵
                PID:6120
            • C:\Users\Admin\AppData\Roaming\Download\883850.exe
              "C:\Users\Admin\AppData\Roaming\Download\883850.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1720
              • C:\Users\Admin\AppData\Roaming\Download\883850.exe
                "C:\Users\Admin\AppData\Roaming\Download\883850.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1368
            • C:\Users\Admin\AppData\Roaming\Download\474542.exe
              "C:\Users\Admin\AppData\Roaming\Download\474542.exe" /Shorttailedrestart
              4⤵
                PID:3216
                • C:\Users\Admin\AppData\Roaming\Download\474542.exe
                  "C:\Users\Admin\AppData\Roaming\Download\474542.exe"
                  5⤵
                    PID:5836
                • C:\Users\Admin\AppData\Roaming\Download\633341.exe
                  "C:\Users\Admin\AppData\Roaming\Download\633341.exe" /Shorttailedrestart
                  4⤵
                    PID:4964
                    • C:\Users\Admin\AppData\Roaming\Download\633341.exe
                      "C:\Users\Admin\AppData\Roaming\Download\633341.exe"
                      5⤵
                        PID:4356
                    • C:\Users\Admin\AppData\Roaming\Download\583328.exe
                      "C:\Users\Admin\AppData\Roaming\Download\583328.exe" /Shorttailedrestart
                      4⤵
                        PID:1628
                        • C:\Users\Admin\AppData\Roaming\Download\583328.exe
                          "C:\Users\Admin\AppData\Roaming\Download\583328.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:4284
                      • C:\Users\Admin\AppData\Roaming\Download\073113.exe
                        "C:\Users\Admin\AppData\Roaming\Download\073113.exe" /Shorttailedrestart
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:6068
                        • C:\Users\Admin\AppData\Roaming\Download\073113.exe
                          "C:\Users\Admin\AppData\Roaming\Download\073113.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:2468
                      • C:\Users\Admin\AppData\Roaming\Download\332010.exe
                        "C:\Users\Admin\AppData\Roaming\Download\332010.exe" /Shorttailedrestart
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1956
                        • C:\Users\Admin\AppData\Roaming\Download\332010.exe
                          "C:\Users\Admin\AppData\Roaming\Download\332010.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:5940
                      • C:\Users\Admin\AppData\Roaming\Download\723624.exe
                        "C:\Users\Admin\AppData\Roaming\Download\723624.exe" /Shorttailedrestart
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4536
                        • C:\Users\Admin\AppData\Roaming\Download\723624.exe
                          "C:\Users\Admin\AppData\Roaming\Download\723624.exe"
                          5⤵
                            PID:3792
                        • C:\Users\Admin\AppData\Roaming\Download\879607.exe
                          "C:\Users\Admin\AppData\Roaming\Download\879607.exe" /Shorttailedrestart
                          4⤵
                            PID:4132
                            • C:\Users\Admin\AppData\Roaming\Download\879607.exe
                              "C:\Users\Admin\AppData\Roaming\Download\879607.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:4992
                          • C:\Users\Admin\AppData\Roaming\Download\571235.exe
                            "C:\Users\Admin\AppData\Roaming\Download\571235.exe" /Shorttailedrestart
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4580
                            • C:\Users\Admin\AppData\Roaming\Download\571235.exe
                              "C:\Users\Admin\AppData\Roaming\Download\571235.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:5396
                          • C:\Users\Admin\AppData\Roaming\Download\116581.exe
                            "C:\Users\Admin\AppData\Roaming\Download\116581.exe" /Shorttailedrestart
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4972
                            • C:\Users\Admin\AppData\Roaming\Download\116581.exe
                              "C:\Users\Admin\AppData\Roaming\Download\116581.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:5084
                          • C:\Users\Admin\AppData\Roaming\Download\618192.exe
                            "C:\Users\Admin\AppData\Roaming\Download\618192.exe" /Shorttailedrestart
                            4⤵
                              PID:5264
                              • C:\Users\Admin\AppData\Roaming\Download\618192.exe
                                "C:\Users\Admin\AppData\Roaming\Download\618192.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2764
                            • C:\Users\Admin\AppData\Roaming\Download\167999.exe
                              "C:\Users\Admin\AppData\Roaming\Download\167999.exe" /Shorttailedrestart
                              4⤵
                                PID:5488
                                • C:\Users\Admin\AppData\Roaming\Download\167999.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\167999.exe"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4376
                              • C:\Users\Admin\AppData\Roaming\Download\660520.exe
                                "C:\Users\Admin\AppData\Roaming\Download\660520.exe" /Shorttailedrestart
                                4⤵
                                  PID:2040
                                  • C:\Users\Admin\AppData\Roaming\Download\660520.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\660520.exe"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2684
                                • C:\Users\Admin\AppData\Roaming\Download\164839.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\164839.exe" /Shorttailedrestart
                                  4⤵
                                    PID:2868
                                    • C:\Users\Admin\AppData\Roaming\Download\164839.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\164839.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2524
                                  • C:\Users\Admin\AppData\Roaming\Download\653743.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\653743.exe" /Shorttailedrestart
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4992
                                    • C:\Users\Admin\AppData\Roaming\Download\653743.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\653743.exe"
                                      5⤵
                                        PID:5920
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                  2⤵
                                  • Drops file in Windows directory
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of WriteProcessMemory
                                  PID:4556
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x36c,0x7ff917e1c188,0x7ff917e1c194,0x7ff917e1c1a0
                                    3⤵
                                      PID:4720
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,4743709202581223442,6430824549489692760,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:11
                                      3⤵
                                      • System Time Discovery
                                      PID:3604
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,497952155070420998,15758103268214956157,262144 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:2
                                      3⤵
                                        PID:4564
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10314768959744075560,15014593155612755550,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
                                        3⤵
                                          PID:2820
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,11624584673875040182,9414927490373574489,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                                          3⤵
                                            PID:4236
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13142110408082868681,1150257341734964576,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                                            3⤵
                                              PID:3856
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,15881134436597643993,13652688789611781057,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
                                              3⤵
                                                PID:780
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5775601161417352630,8992059649826222684,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:9
                                                3⤵
                                                  PID:2596
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,8731582879429867799,12387116410158558574,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
                                                  3⤵
                                                    PID:5744
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,197885535238568834,167135129693183673,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                                    3⤵
                                                      PID:4152
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,4855411285585057075,6116509079142732990,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                                                      3⤵
                                                        PID:5512
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9786568523588664995,4975003236383096158,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                                        3⤵
                                                          PID:6064
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9786568523588664995,4975003236383096158,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                                          3⤵
                                                            PID:4524
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,13961049150956582921,7980589926365234401,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                            3⤵
                                                              PID:2096
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10503989005565828109,4941301154736447218,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                              3⤵
                                                                PID:1992
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6592,i,9810307999206770818,11757551398589860872,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
                                                                3⤵
                                                                  PID:5164
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5805480448939067004,6460236552190170016,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
                                                                  3⤵
                                                                    PID:2920
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,16513695049038083687,9724844012742537932,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
                                                                    3⤵
                                                                      PID:4236
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,15845313658897248778,13379171430183752169,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
                                                                      3⤵
                                                                      • Modifies registry class
                                                                      PID:5044
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,9870140869541906041,14533135564435912481,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:12
                                                                      3⤵
                                                                        PID:3936
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7036,i,14601375862859314897,12235939830119054078,2097152 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
                                                                        3⤵
                                                                          PID:5308
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6744004234126510803,5870508943583921270,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                                          3⤵
                                                                            PID:1892
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12001653054390518394,17748429514659802810,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
                                                                            3⤵
                                                                              PID:904
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,18088133856200477407,14977908255386401533,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                                                              3⤵
                                                                                PID:3064
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8374992480932741228,8579021414085958587,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
                                                                                3⤵
                                                                                  PID:5668
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,11030259455219996571,11093251717488532671,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
                                                                                  3⤵
                                                                                    PID:1060
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,9181166551099052934,14172285394335106557,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                                                                                    3⤵
                                                                                      PID:3760
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,3273199013166381793,4643072237921244327,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
                                                                                      3⤵
                                                                                        PID:4200
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,15804652473016813727,12869122909275721981,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
                                                                                        3⤵
                                                                                          PID:1448
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,2383541865393743871,12191285285837345675,262144 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:10
                                                                                          3⤵
                                                                                            PID:4940
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,16720723241465600366,15365782550534885760,524288 --field-trial-handle=2740,i,3976084279600560772,1341769033006976475,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
                                                                                            3⤵
                                                                                              PID:1796
                                                                                          • C:\Windows\explorer.exe
                                                                                            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                            2⤵
                                                                                              PID:5196
                                                                                          • C:\Windows\explorer.exe
                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5528
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:4088
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:5896
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:4132

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    DouTuDaShi.exe
                                                                                                    • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                    • Size 1.1MB
                                                                                                    • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    7c2ae840-245f-4e39-9401-d73a58f64c75.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c2ae840-245f-4e39-9401-d73a58f64c75.tmp
                                                                                                    • Size 12KB
                                                                                                    • SHA256 55ed3eaeeccaf2e72f20b7cc037dec9972f3d508ce51c5fac97403f9f96fa6b3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    96f9b4f9adf74a24_0
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                    • Size 213B
                                                                                                    • SHA256 70c26737aed111cb9d37a55aa9ebe98ec12547a9dc6ab4c7be77e6beefc04160
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 3KB
                                                                                                    • SHA256 985b3302946a259f8848e5c6ba269ba24d7ce4fa06d423c09a47213fd8895fb0
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 3KB
                                                                                                    • SHA256 11dd86adab4d9e387a22d925bfc8933577e4e9f92f76e9a18099a1432cedcf3b
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe5a0725.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0725.TMP
                                                                                                    • Size 2KB
                                                                                                    • SHA256 81d790ba1d5b3166ed481b8734f3d4a6b4addce64993aaffd07a1ab0b9333644
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SiteList-Enterprise.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Edge Profile.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 7KB
                                                                                                    • SHA256 f535434382ee331081a2a17145f95644c2cb718b65c8858447d1d4b469020cbe
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Sdch Dictionaries
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                    • Size 40B
                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 13KB
                                                                                                    • SHA256 74173868aa0b0f6b715cc6d2714ab0d722cc12fd35111ff21d9199121cff0b28
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 8e8cf48b739b56cc24af22616b7a0dd2c432609b9d7360fe16b574fc9d1e39c2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Secure Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                    • Size 29KB
                                                                                                    • SHA256 e9280802e07f42dc45840fed41a81470e9e476445f7c6bea948cd45f80a158f5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    a5d345d7-0528-4eae-966d-010af48cb401.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a5d345d7-0528-4eae-966d-010af48cb401.tmp
                                                                                                    • Size 22KB
                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 43KB
                                                                                                    • SHA256 77e7fadf5eb8671e06765bfaef999708fd6e3ee5e80472721712cd020e4ff911
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 35KB
                                                                                                    • SHA256 474fadfc4ea5a642158451c9054d16c507d3976680bb8f3c08bf3283b16851a2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 88ce58ad1bca25f9b4be6674318c30c71b6cc6ae33a2343235fe351cb2f84773
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 38KB
                                                                                                    • SHA256 5e84d9485bf9911dacb47300293ae6eecff5551c3691c724006d1abceb8b2499
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 132B
                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 252B
                                                                                                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 372B
                                                                                                    • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • Size 153KB
                                                                                                    • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    9d952f24-b0ef-4efb-b571-86057d34c703.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d952f24-b0ef-4efb-b571-86057d34c703.tmp
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    metadata.json~RFe599e2a.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe599e2a.TMP
                                                                                                    • Size 132B
                                                                                                    • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    e04bcb5f-dfbd-4fb1-b4e7-7f808bafc17c.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\e04bcb5f-dfbd-4fb1-b4e7-7f808bafc17c.tmp
                                                                                                    • Size 1B
                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    ldsajdklsajdlkjsalkda.bat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                    • Size 589B
                                                                                                    • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    content_new.js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4556_847023171\CRX_INSTALL\content_new.js
                                                                                                    • Size 10KB
                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ygdyef.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ygdyef.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 dd1f3232d52739c323fa87cfc0d5aad465e1883fcdd108846cb34f5c788b9afe
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    056168.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\056168.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 23e7a635b345d3d0d0d32d96fe9407e246cc31249ba820c45de837cdd61879c7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    215769.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\215769.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 803d438e671052407393baa7580882b2501757be95f9b656a931be7efe224b31
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    222025.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\222025.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 25d44336c499a3811d42e8bd97bbf8257bde487e84987039edd24dc73dc525cb
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    423146.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\423146.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 c08055419538a254523b9487f79475d58e800dd76591d2ed1e840a3766d2ee6c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    476474.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\476474.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 f5679aa3e4fc6d82a61c2551d7d142d67fe055e6d224c9d77cc22141352c0028
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    513439.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\513439.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 65f4e2d401390188fcec0535475abfe9935bfee35f08d16f2b2343c1257ccade
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    543157.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\543157.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 bd42ba2d3212e5de356b74ad74905cd8b0e150a8bc64f6de01e6860ef466c18b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    664189.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\664189.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 4bc83b63023a0d0da1fa1157d4bca191a2a91418441c7199d4654d35d6a2dc7b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    690729.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\690729.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 c2dee868112e4e46161f8416994a3a97b39d5e2f9f2506e709e4feca14f1adf6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    765188.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\765188.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 a2c27bd62a525cd499b47983cf454204b72c8c7f78d2c01a2296f2b3bcaea0d1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    859618.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\859618.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 c0a95bd576f02bd59f7fd3490249858909cdcc54397b258f39cd8431a3da740c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    927675.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\927675.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 8fedf77805bd03427441d9a17c860af8ed9f3ee87dc2601b84da1079e6764290
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    950658.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\950658.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 0e93f70de6be0a3f2e3115dce7dc1b2bf348686fb41f6092e101ddfa85d88c2e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    memory/964-124-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-1041-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-800-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-745-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-934-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-829-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-696-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-873-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-630-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-1086-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-1122-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-309-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-1169-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4448-1198-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download