Overview

overview

7

Static

static

3

2026-08-25...op.exe

windows10-2004-x64

7

2026-08-25...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    81s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260826-ce9xtabd73
  • SHA256 074a922ef53d5b36ef1564f69b2ebae4f13a9b39e6bb24f3988dabbc8d4ad536
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Executes dropped EXE 55 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4b09e7ef76c05d3a45973bfee1100fb_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5396
    • C:\Users\Admin\AppData\Local\Temp\ynrllq.exe
      "C:\Users\Admin\AppData\Local\Temp\ynrllq.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Users\Admin\AppData\Local\Temp\ynrllq.exe
        "C:\Users\Admin\AppData\Local\Temp\ynrllq.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Roaming\Download\602625.exe
          "C:\Users\Admin\AppData\Roaming\Download\602625.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Users\Admin\AppData\Roaming\Download\602625.exe
            "C:\Users\Admin\AppData\Roaming\Download\602625.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4860
        • C:\Users\Admin\AppData\Roaming\Download\698224.exe
          "C:\Users\Admin\AppData\Roaming\Download\698224.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Users\Admin\AppData\Roaming\Download\698224.exe
            "C:\Users\Admin\AppData\Roaming\Download\698224.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5404
        • C:\Users\Admin\AppData\Roaming\Download\089938.exe
          "C:\Users\Admin\AppData\Roaming\Download\089938.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3088
          • C:\Users\Admin\AppData\Roaming\Download\089938.exe
            "C:\Users\Admin\AppData\Roaming\Download\089938.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4268
        • C:\Users\Admin\AppData\Roaming\Download\884363.exe
          "C:\Users\Admin\AppData\Roaming\Download\884363.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Users\Admin\AppData\Roaming\Download\884363.exe
            "C:\Users\Admin\AppData\Roaming\Download\884363.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3660
        • C:\Users\Admin\AppData\Roaming\Download\210087.exe
          "C:\Users\Admin\AppData\Roaming\Download\210087.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3984
          • C:\Users\Admin\AppData\Roaming\Download\210087.exe
            "C:\Users\Admin\AppData\Roaming\Download\210087.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5316
        • C:\Users\Admin\AppData\Roaming\Download\591791.exe
          "C:\Users\Admin\AppData\Roaming\Download\591791.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Users\Admin\AppData\Roaming\Download\591791.exe
            "C:\Users\Admin\AppData\Roaming\Download\591791.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5980
        • C:\Users\Admin\AppData\Roaming\Download\048599.exe
          "C:\Users\Admin\AppData\Roaming\Download\048599.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Users\Admin\AppData\Roaming\Download\048599.exe
            "C:\Users\Admin\AppData\Roaming\Download\048599.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1596
        • C:\Users\Admin\AppData\Roaming\Download\747557.exe
          "C:\Users\Admin\AppData\Roaming\Download\747557.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1540
          • C:\Users\Admin\AppData\Roaming\Download\747557.exe
            "C:\Users\Admin\AppData\Roaming\Download\747557.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:952
        • C:\Users\Admin\AppData\Roaming\Download\342705.exe
          "C:\Users\Admin\AppData\Roaming\Download\342705.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3376
          • C:\Users\Admin\AppData\Roaming\Download\342705.exe
            "C:\Users\Admin\AppData\Roaming\Download\342705.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4268
        • C:\Users\Admin\AppData\Roaming\Download\188148.exe
          "C:\Users\Admin\AppData\Roaming\Download\188148.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5980
          • C:\Users\Admin\AppData\Roaming\Download\188148.exe
            "C:\Users\Admin\AppData\Roaming\Download\188148.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4832
        • C:\Users\Admin\AppData\Roaming\Download\447928.exe
          "C:\Users\Admin\AppData\Roaming\Download\447928.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1576
          • C:\Users\Admin\AppData\Roaming\Download\447928.exe
            "C:\Users\Admin\AppData\Roaming\Download\447928.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5140
        • C:\Users\Admin\AppData\Roaming\Download\183288.exe
          "C:\Users\Admin\AppData\Roaming\Download\183288.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2596
          • C:\Users\Admin\AppData\Roaming\Download\183288.exe
            "C:\Users\Admin\AppData\Roaming\Download\183288.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3912
        • C:\Users\Admin\AppData\Roaming\Download\746904.exe
          "C:\Users\Admin\AppData\Roaming\Download\746904.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1792
          • C:\Users\Admin\AppData\Roaming\Download\746904.exe
            "C:\Users\Admin\AppData\Roaming\Download\746904.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5752
        • C:\Users\Admin\AppData\Roaming\Download\891864.exe
          "C:\Users\Admin\AppData\Roaming\Download\891864.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4508
          • C:\Users\Admin\AppData\Roaming\Download\891864.exe
            "C:\Users\Admin\AppData\Roaming\Download\891864.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:360
        • C:\Users\Admin\AppData\Roaming\Download\540127.exe
          "C:\Users\Admin\AppData\Roaming\Download\540127.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5412
          • C:\Users\Admin\AppData\Roaming\Download\540127.exe
            "C:\Users\Admin\AppData\Roaming\Download\540127.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5648
        • C:\Users\Admin\AppData\Roaming\Download\966432.exe
          "C:\Users\Admin\AppData\Roaming\Download\966432.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3680
          • C:\Users\Admin\AppData\Roaming\Download\966432.exe
            "C:\Users\Admin\AppData\Roaming\Download\966432.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4668
        • C:\Users\Admin\AppData\Roaming\Download\460971.exe
          "C:\Users\Admin\AppData\Roaming\Download\460971.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3656
          • C:\Users\Admin\AppData\Roaming\Download\460971.exe
            "C:\Users\Admin\AppData\Roaming\Download\460971.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4356
        • C:\Users\Admin\AppData\Roaming\Download\719861.exe
          "C:\Users\Admin\AppData\Roaming\Download\719861.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5532
          • C:\Users\Admin\AppData\Roaming\Download\719861.exe
            "C:\Users\Admin\AppData\Roaming\Download\719861.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2988
        • C:\Users\Admin\AppData\Roaming\Download\178648.exe
          "C:\Users\Admin\AppData\Roaming\Download\178648.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5204
          • C:\Users\Admin\AppData\Roaming\Download\178648.exe
            "C:\Users\Admin\AppData\Roaming\Download\178648.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5040
        • C:\Users\Admin\AppData\Roaming\Download\548552.exe
          "C:\Users\Admin\AppData\Roaming\Download\548552.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4884
          • C:\Users\Admin\AppData\Roaming\Download\548552.exe
            "C:\Users\Admin\AppData\Roaming\Download\548552.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3640
        • C:\Users\Admin\AppData\Roaming\Download\060891.exe
          "C:\Users\Admin\AppData\Roaming\Download\060891.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3368
          • C:\Users\Admin\AppData\Roaming\Download\060891.exe
            "C:\Users\Admin\AppData\Roaming\Download\060891.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1120
        • C:\Users\Admin\AppData\Roaming\Download\564422.exe
          "C:\Users\Admin\AppData\Roaming\Download\564422.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4204
          • C:\Users\Admin\AppData\Roaming\Download\564422.exe
            "C:\Users\Admin\AppData\Roaming\Download\564422.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:772
        • C:\Users\Admin\AppData\Roaming\Download\371847.exe
          "C:\Users\Admin\AppData\Roaming\Download\371847.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5832
          • C:\Users\Admin\AppData\Roaming\Download\371847.exe
            "C:\Users\Admin\AppData\Roaming\Download\371847.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2172
        • C:\Users\Admin\AppData\Roaming\Download\486466.exe
          "C:\Users\Admin\AppData\Roaming\Download\486466.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3664
          • C:\Users\Admin\AppData\Roaming\Download\486466.exe
            "C:\Users\Admin\AppData\Roaming\Download\486466.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3348
        • C:\Users\Admin\AppData\Roaming\Download\194508.exe
          "C:\Users\Admin\AppData\Roaming\Download\194508.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4192
          • C:\Users\Admin\AppData\Roaming\Download\194508.exe
            "C:\Users\Admin\AppData\Roaming\Download\194508.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3792
        • C:\Users\Admin\AppData\Roaming\Download\419307.exe
          "C:\Users\Admin\AppData\Roaming\Download\419307.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2240
          • C:\Users\Admin\AppData\Roaming\Download\419307.exe
            "C:\Users\Admin\AppData\Roaming\Download\419307.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4860
        • C:\Users\Admin\AppData\Roaming\Download\748196.exe
          "C:\Users\Admin\AppData\Roaming\Download\748196.exe" /Shorttailedrestart
          4⤵
            PID:1188
            • C:\Users\Admin\AppData\Roaming\Download\748196.exe
              "C:\Users\Admin\AppData\Roaming\Download\748196.exe"
              5⤵
                PID:3756
            • C:\Users\Admin\AppData\Roaming\Download\518163.exe
              "C:\Users\Admin\AppData\Roaming\Download\518163.exe" /Shorttailedrestart
              4⤵
                PID:4296
                • C:\Users\Admin\AppData\Roaming\Download\518163.exe
                  "C:\Users\Admin\AppData\Roaming\Download\518163.exe"
                  5⤵
                    PID:772
                • C:\Users\Admin\AppData\Roaming\Download\353407.exe
                  "C:\Users\Admin\AppData\Roaming\Download\353407.exe" /Shorttailedrestart
                  4⤵
                    PID:4244
                    • C:\Users\Admin\AppData\Roaming\Download\353407.exe
                      "C:\Users\Admin\AppData\Roaming\Download\353407.exe"
                      5⤵
                        PID:4412
                    • C:\Users\Admin\AppData\Roaming\Download\855038.exe
                      "C:\Users\Admin\AppData\Roaming\Download\855038.exe" /Shorttailedrestart
                      4⤵
                        PID:1432
                        • C:\Users\Admin\AppData\Roaming\Download\855038.exe
                          "C:\Users\Admin\AppData\Roaming\Download\855038.exe"
                          5⤵
                            PID:3384
                        • C:\Users\Admin\AppData\Roaming\Download\861105.exe
                          "C:\Users\Admin\AppData\Roaming\Download\861105.exe" /Shorttailedrestart
                          4⤵
                            PID:1060
                            • C:\Users\Admin\AppData\Roaming\Download\861105.exe
                              "C:\Users\Admin\AppData\Roaming\Download\861105.exe"
                              5⤵
                                PID:2364
                            • C:\Users\Admin\AppData\Roaming\Download\563614.exe
                              "C:\Users\Admin\AppData\Roaming\Download\563614.exe" /Shorttailedrestart
                              4⤵
                                PID:3336
                                • C:\Users\Admin\AppData\Roaming\Download\563614.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\563614.exe"
                                  5⤵
                                    PID:5760
                                • C:\Users\Admin\AppData\Roaming\Download\554407.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\554407.exe" /Shorttailedrestart
                                  4⤵
                                    PID:5984
                                    • C:\Users\Admin\AppData\Roaming\Download\554407.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\554407.exe"
                                      5⤵
                                        PID:4300
                                    • C:\Users\Admin\AppData\Roaming\Download\917102.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\917102.exe" /Shorttailedrestart
                                      4⤵
                                        PID:4360
                                        • C:\Users\Admin\AppData\Roaming\Download\917102.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\917102.exe"
                                          5⤵
                                            PID:2080
                                        • C:\Users\Admin\AppData\Roaming\Download\611731.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\611731.exe" /Shorttailedrestart
                                          4⤵
                                            PID:4916
                                            • C:\Users\Admin\AppData\Roaming\Download\611731.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\611731.exe"
                                              5⤵
                                                PID:3980
                                            • C:\Users\Admin\AppData\Roaming\Download\114262.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\114262.exe" /Shorttailedrestart
                                              4⤵
                                                PID:1600
                                                • C:\Users\Admin\AppData\Roaming\Download\114262.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\114262.exe"
                                                  5⤵
                                                    PID:4184
                                                • C:\Users\Admin\AppData\Roaming\Download\871203.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\871203.exe" /Shorttailedrestart
                                                  4⤵
                                                    PID:3384
                                                    • C:\Users\Admin\AppData\Roaming\Download\871203.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\871203.exe"
                                                      5⤵
                                                        PID:5684
                                                    • C:\Users\Admin\AppData\Roaming\Download\243026.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\243026.exe" /Shorttailedrestart
                                                      4⤵
                                                        PID:3756
                                                        • C:\Users\Admin\AppData\Roaming\Download\243026.exe
                                                          "C:\Users\Admin\AppData\Roaming\Download\243026.exe"
                                                          5⤵
                                                            PID:2680
                                                        • C:\Users\Admin\AppData\Roaming\Download\180289.exe
                                                          "C:\Users\Admin\AppData\Roaming\Download\180289.exe" /Shorttailedrestart
                                                          4⤵
                                                            PID:3020
                                                            • C:\Users\Admin\AppData\Roaming\Download\180289.exe
                                                              "C:\Users\Admin\AppData\Roaming\Download\180289.exe"
                                                              5⤵
                                                                PID:3016
                                                            • C:\Users\Admin\AppData\Roaming\Download\797614.exe
                                                              "C:\Users\Admin\AppData\Roaming\Download\797614.exe" /Shorttailedrestart
                                                              4⤵
                                                                PID:4712
                                                                • C:\Users\Admin\AppData\Roaming\Download\797614.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Download\797614.exe"
                                                                  5⤵
                                                                    PID:3280
                                                                • C:\Users\Admin\AppData\Roaming\Download\434775.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Download\434775.exe" /Shorttailedrestart
                                                                  4⤵
                                                                    PID:3792
                                                                    • C:\Users\Admin\AppData\Roaming\Download\434775.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Download\434775.exe"
                                                                      5⤵
                                                                        PID:4316
                                                                    • C:\Users\Admin\AppData\Roaming\Download\889858.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Download\889858.exe" /Shorttailedrestart
                                                                      4⤵
                                                                        PID:3136
                                                                        • C:\Users\Admin\AppData\Roaming\Download\889858.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Download\889858.exe"
                                                                          5⤵
                                                                            PID:4140
                                                                        • C:\Users\Admin\AppData\Roaming\Download\038737.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Download\038737.exe" /Shorttailedrestart
                                                                          4⤵
                                                                            PID:4184
                                                                            • C:\Users\Admin\AppData\Roaming\Download\038737.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Download\038737.exe"
                                                                              5⤵
                                                                                PID:1612
                                                                            • C:\Users\Admin\AppData\Roaming\Download\439349.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Download\439349.exe" /Shorttailedrestart
                                                                              4⤵
                                                                                PID:5684
                                                                                • C:\Users\Admin\AppData\Roaming\Download\439349.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Download\439349.exe"
                                                                                  5⤵
                                                                                    PID:1780
                                                                                • C:\Users\Admin\AppData\Roaming\Download\133970.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Download\133970.exe" /Shorttailedrestart
                                                                                  4⤵
                                                                                    PID:4684
                                                                                    • C:\Users\Admin\AppData\Roaming\Download\133970.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Download\133970.exe"
                                                                                      5⤵
                                                                                        PID:1276
                                                                                    • C:\Users\Admin\AppData\Roaming\Download\983837.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Download\983837.exe" /Shorttailedrestart
                                                                                      4⤵
                                                                                        PID:5744
                                                                                        • C:\Users\Admin\AppData\Roaming\Download\983837.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Download\983837.exe"
                                                                                          5⤵
                                                                                            PID:4288
                                                                                        • C:\Users\Admin\AppData\Roaming\Download\232636.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Download\232636.exe" /Shorttailedrestart
                                                                                          4⤵
                                                                                            PID:5816
                                                                                            • C:\Users\Admin\AppData\Roaming\Download\232636.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Download\232636.exe"
                                                                                              5⤵
                                                                                                PID:2772
                                                                                            • C:\Users\Admin\AppData\Roaming\Download\075080.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Download\075080.exe" /Shorttailedrestart
                                                                                              4⤵
                                                                                                PID:3288
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                                                                            2⤵
                                                                                            • Drops file in Windows directory
                                                                                            • Enumerates system info in registry
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4744
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ff862a8c188,0x7ff862a8c194,0x7ff862a8c1a0
                                                                                              3⤵
                                                                                                PID:6096
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,8308361232166450040,17258348804407593753,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
                                                                                                3⤵
                                                                                                • System Time Discovery
                                                                                                PID:5148
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,7963365337608577947,8007360280914632739,262144 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
                                                                                                3⤵
                                                                                                  PID:2288
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,14867354287118514070,12325131082500337395,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
                                                                                                  3⤵
                                                                                                    PID:4284
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,177382141474659102,5229659790520871301,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                                                                                    3⤵
                                                                                                      PID:4220
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3767762107198809610,15137139099689145230,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:4132
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,8857346607818681283,16385179523858479885,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
                                                                                                        3⤵
                                                                                                          PID:4776
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,8626925826593722146,975300674230270503,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
                                                                                                          3⤵
                                                                                                            PID:4828
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3807464938538335609,15942569270447390773,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:5420
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3624,i,11341126292116764138,6016839495995613222,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                                                                                                              3⤵
                                                                                                                PID:5688
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,8698039826822210914,13615789356349937926,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:5300
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,11377535806547965737,9095561028903219601,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
                                                                                                                  3⤵
                                                                                                                    PID:3448
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3714838068739411104,15915143225967579800,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                                                                                                                    3⤵
                                                                                                                      PID:4424
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11888600726039186132,6123425021888791234,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:12
                                                                                                                      3⤵
                                                                                                                        PID:5712
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,9168882194309148334,2427884779496789564,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        PID:5392
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3714838068739411104,15915143225967579800,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                                                                                                                        3⤵
                                                                                                                          PID:1576
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16013121390994366742,6717967937571053429,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
                                                                                                                          3⤵
                                                                                                                            PID:4220
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,4148738067240207242,2146779714865582421,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
                                                                                                                            3⤵
                                                                                                                              PID:4432
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,17063904917967669768,11483566791739798170,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                                                                                                              3⤵
                                                                                                                                PID:3028
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,9563897617841960152,7648872169139155113,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
                                                                                                                                3⤵
                                                                                                                                  PID:5476
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7212,i,11804748352866101454,867135662606719400,2097152 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:2436
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,6413554646359447170,17437134413473856172,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                                                                                                                    3⤵
                                                                                                                                      PID:5808
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,5434044067094613728,9826376586591553121,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
                                                                                                                                      3⤵
                                                                                                                                        PID:4152
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,16749729854294792044,9481275611598460822,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
                                                                                                                                        3⤵
                                                                                                                                          PID:996
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,8444123549031151068,15131169253363257816,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:14
                                                                                                                                          3⤵
                                                                                                                                            PID:4436
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,17547988890877145287,15089581889147547449,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
                                                                                                                                            3⤵
                                                                                                                                              PID:4316
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4994055178333693576,11082824421548214005,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                                                                                                                              3⤵
                                                                                                                                                PID:952
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4132,i,9386229047328125168,11092375622003781641,262144 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:10
                                                                                                                                                3⤵
                                                                                                                                                  PID:4524
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11260024987919273812,12751060836764699737,524288 --field-trial-handle=2516,i,2855156824673937648,10051806639190460930,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2384
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3940
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:2416
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4908
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1208
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3984
                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4356

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            DouTuDaShi.exe
                                                                                                                                                            • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                                                                            • Size 1.1MB
                                                                                                                                                            • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            96f9b4f9adf74a24_0
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                                                                            • Size 213B
                                                                                                                                                            • SHA256 3f181b774a1a9e165a6a6e96805ecc86be0fcd1bb38c2da86a0f815b3fad3b57
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            df36dda3fc61f9c6_0
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df36dda3fc61f9c6_0
                                                                                                                                                            • Size 219B
                                                                                                                                                            • SHA256 5e50e051ba110397be2a47956b61311e9bd712d9a36c2165165bb65acb58cf33
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 aa63c69eaec76cf088bd2473a17a4ec1bcd737028e2b4de42c545cd6a36f9b5f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index~RFe5a1474.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1474.TMP
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 26e315d6d34c9e5e4dccf9dbbd4f31b655aeb11dc4af75f6155356aeb6739e9e
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Edge Profile.ico
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                            • Size 70KB
                                                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 4dcd2f52446951da5bebd9308962db7e43421b713350edd415abee4cfb610d05
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Sdch Dictionaries
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                            • Size 40B
                                                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 13KB
                                                                                                                                                            • SHA256 ae792ed46b9801371197d54ff5498c074e3a69389c6819677e88a84d05542701
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 12KB
                                                                                                                                                            • SHA256 11e799d8f499aa188389a03549d4a79ede8075bff0ba9b53e734da6417d0214f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 12KB
                                                                                                                                                            • SHA256 fa0a971894defe852185d74dac715abee9fefa12abc1c46ebaa807fd71a9a8f9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                            • Size 29KB
                                                                                                                                                            • SHA256 96e7e5cae119f893334d064e487cab9ec7f505e2941f99cea2380b8e340e7d62
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            OperationConfig
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                            • Size 22KB
                                                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            OperationConfig~RFe5a5ca8.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5ca8.TMP
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 42KB
                                                                                                                                                            • SHA256 04e7b5308b4e1968864025f74c9a7346d530bc8341d0b1fd3132678cd746014b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 34KB
                                                                                                                                                            • SHA256 90529cfaeaf4e6028d80aec6ef0453014add3facfe755937afc603275c80bbe1
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 39KB
                                                                                                                                                            • SHA256 26a6970696421b23b288d80ca5a0c31b5a9a1cefc62bb3c00be9498ec70368ec
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 34KB
                                                                                                                                                            • SHA256 5b691164f9f999e9654039cd3b93a92cf131e1fb07b6b1db0cee0983317636fd
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 38KB
                                                                                                                                                            • SHA256 74a4de564c03dcd51f5bc69332a485c3002022b276e922e2f23c985ab6cd9544
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 39KB
                                                                                                                                                            • SHA256 dd6c1871cd93cb3f6aa2fce666c12c15fc22deba421db5d1aba1df6f8f7c459d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 252B
                                                                                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            15d770e1-ca47-4e74-af38-c43b4cf3a082.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15d770e1-ca47-4e74-af38-c43b4cf3a082.tmp
                                                                                                                                                            • Size 13B
                                                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                            • Size 154KB
                                                                                                                                                            • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json~RFe59990a.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59990a.TMP
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            hao.360[1].xml
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HM357J3M\hao.360[1].xml
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 b2053c10222743bdfa07b3d946aee9149a683408058bf73b1f8f14711b076bc9
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            hao.360[1].xml
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HM357J3M\hao.360[1].xml
                                                                                                                                                            • Size 52KB
                                                                                                                                                            • SHA256 0e3677a073fc2a00b56e2bbcae6d5d16915e1a1147c46d50eb16530f98d91653
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            hao.360[1].xml
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HM357J3M\hao.360[1].xml
                                                                                                                                                            • Size 56KB
                                                                                                                                                            • SHA256 683de56a8e45272d1e50d0646b69295fb2bc13de3effc56af477f34b3a4789e1
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            113[1].js
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EPL1VUQZ\113[1].js
                                                                                                                                                            • Size 61KB
                                                                                                                                                            • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ade7c467-b66b-4b4d-8d3b-df948329dd28.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ade7c467-b66b-4b4d-8d3b-df948329dd28.tmp
                                                                                                                                                            • Size 1B
                                                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            ldsajdklsajdlkjsalkda.bat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                                                            • Size 589B
                                                                                                                                                            • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            content_new.js
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4744_1770533970\CRX_INSTALL\content_new.js
                                                                                                                                                            • Size 10KB
                                                                                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ynrllq.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ynrllq.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 074a922ef53d5b36ef1564f69b2ebae4f13a9b39e6bb24f3988dabbc8d4ad536
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            048599.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\048599.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 a3359d0889a8325152ef7538ffb002e60dbd911b1120353ba16e6c72ec031a08
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            089938.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\089938.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 26e4544a8951cad0e48fe389c14cd575644c7c3814bf8cec0cfceaad7ad83487
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            183288.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\183288.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 fc5cfb0ac36566274b0be1929da00a6b92722f20622977dc516eb16699fab2b9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            188148.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\188148.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 c48f89356c7ab8e202c4491868a5d4fafa788781e14afb852c1b6403c1b1ef52
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            210087.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\210087.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 1bd7471da1d0bf838da1b17c35e9df76a46ed544829d15e761fca34a2718bfce
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            342705.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\342705.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 7aa34afe8dbb06510a74b0c7184c8f7379daa6fcd261d0f02fe0c96b89a02462
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            447928.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\447928.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 78ca0d2a2630a279a5cd172c3e281dd4553d88b1854b2b8ec4644a2d1b16137f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            591791.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\591791.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 03e92e825602a01ee17fece9e7bdc9885c7202fff91506830f0db131c1459372
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            602625.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\602625.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 4d6e7c94e416fb0d6e03b395cf9c0fc56e5801a5a96114e337c228fcc5e655b1
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            698224.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\698224.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 dbab0f10a4a139602428c60452ed0e5848d66a8f35fb799400715eaf0c8437b1
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            746904.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\746904.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 d39aa6444e6b8c65a9466f132c9718f1d7a1627f0c9e67eedcd50b9d437c4feb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            747557.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\747557.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 cbef59d67946337ba4d2c1625d38bf31b2eb3ec123ce847dae57c60237034f13
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            884363.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\884363.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 3f7d20f9015ee402b178ba64bce27694188b0b7c108034b45e16bf0915e4bf1f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            memory/2300-166-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-693-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1247-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1288-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1334-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1363-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1408-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-270-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1454-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2592-1483-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5396-72-0x000000000D1D0000-0x000000000D2D0000-memory.dmp
                                                                                                                                                            Download