Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    137s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-epmalswarg
  • SHA256 29369076a9c32dbbeca01224e74e09fbb4da57be689350f41ccb5716ecc2f957
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_271f8202fe46118a7e881aebf94a6583_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:6072
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5824
    • C:\Users\Admin\AppData\Local\Temp\nubcle.exe
      "C:\Users\Admin\AppData\Local\Temp\nubcle.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:124
      • C:\Users\Admin\AppData\Local\Temp\nubcle.exe
        "C:\Users\Admin\AppData\Local\Temp\nubcle.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:352
        • C:\Users\Admin\AppData\Roaming\Download\360064.exe
          "C:\Users\Admin\AppData\Roaming\Download\360064.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Users\Admin\AppData\Roaming\Download\360064.exe
            "C:\Users\Admin\AppData\Roaming\Download\360064.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3812
        • C:\Users\Admin\AppData\Roaming\Download\547653.exe
          "C:\Users\Admin\AppData\Roaming\Download\547653.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Users\Admin\AppData\Roaming\Download\547653.exe
            "C:\Users\Admin\AppData\Roaming\Download\547653.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5432
        • C:\Users\Admin\AppData\Roaming\Download\847611.exe
          "C:\Users\Admin\AppData\Roaming\Download\847611.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6016
          • C:\Users\Admin\AppData\Roaming\Download\847611.exe
            "C:\Users\Admin\AppData\Roaming\Download\847611.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6020
        • C:\Users\Admin\AppData\Roaming\Download\924119.exe
          "C:\Users\Admin\AppData\Roaming\Download\924119.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Users\Admin\AppData\Roaming\Download\924119.exe
            "C:\Users\Admin\AppData\Roaming\Download\924119.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5116
        • C:\Users\Admin\AppData\Roaming\Download\627640.exe
          "C:\Users\Admin\AppData\Roaming\Download\627640.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3996
          • C:\Users\Admin\AppData\Roaming\Download\627640.exe
            "C:\Users\Admin\AppData\Roaming\Download\627640.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:616
        • C:\Users\Admin\AppData\Roaming\Download\544181.exe
          "C:\Users\Admin\AppData\Roaming\Download\544181.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5716
          • C:\Users\Admin\AppData\Roaming\Download\544181.exe
            "C:\Users\Admin\AppData\Roaming\Download\544181.exe"
            5⤵
            • Executes dropped EXE
            PID:5244
        • C:\Users\Admin\AppData\Roaming\Download\848864.exe
          "C:\Users\Admin\AppData\Roaming\Download\848864.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4796
          • C:\Users\Admin\AppData\Roaming\Download\848864.exe
            "C:\Users\Admin\AppData\Roaming\Download\848864.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3388
        • C:\Users\Admin\AppData\Roaming\Download\397743.exe
          "C:\Users\Admin\AppData\Roaming\Download\397743.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Users\Admin\AppData\Roaming\Download\397743.exe
            "C:\Users\Admin\AppData\Roaming\Download\397743.exe"
            5⤵
            • Executes dropped EXE
            PID:760
        • C:\Users\Admin\AppData\Roaming\Download\899272.exe
          "C:\Users\Admin\AppData\Roaming\Download\899272.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Users\Admin\AppData\Roaming\Download\899272.exe
            "C:\Users\Admin\AppData\Roaming\Download\899272.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2672
        • C:\Users\Admin\AppData\Roaming\Download\944454.exe
          "C:\Users\Admin\AppData\Roaming\Download\944454.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2860
          • C:\Users\Admin\AppData\Roaming\Download\944454.exe
            "C:\Users\Admin\AppData\Roaming\Download\944454.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4676
        • C:\Users\Admin\AppData\Roaming\Download\580690.exe
          "C:\Users\Admin\AppData\Roaming\Download\580690.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3340
          • C:\Users\Admin\AppData\Roaming\Download\580690.exe
            "C:\Users\Admin\AppData\Roaming\Download\580690.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2668
        • C:\Users\Admin\AppData\Roaming\Download\874966.exe
          "C:\Users\Admin\AppData\Roaming\Download\874966.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4456
          • C:\Users\Admin\AppData\Roaming\Download\874966.exe
            "C:\Users\Admin\AppData\Roaming\Download\874966.exe"
            5⤵
            • Executes dropped EXE
            PID:3660
        • C:\Users\Admin\AppData\Roaming\Download\164650.exe
          "C:\Users\Admin\AppData\Roaming\Download\164650.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5844
          • C:\Users\Admin\AppData\Roaming\Download\164650.exe
            "C:\Users\Admin\AppData\Roaming\Download\164650.exe"
            5⤵
            • Executes dropped EXE
            PID:3424
        • C:\Users\Admin\AppData\Roaming\Download\668181.exe
          "C:\Users\Admin\AppData\Roaming\Download\668181.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3580
          • C:\Users\Admin\AppData\Roaming\Download\668181.exe
            "C:\Users\Admin\AppData\Roaming\Download\668181.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5432
        • C:\Users\Admin\AppData\Roaming\Download\535251.exe
          "C:\Users\Admin\AppData\Roaming\Download\535251.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5856
          • C:\Users\Admin\AppData\Roaming\Download\535251.exe
            "C:\Users\Admin\AppData\Roaming\Download\535251.exe"
            5⤵
            • Executes dropped EXE
            PID:3468
        • C:\Users\Admin\AppData\Roaming\Download\884050.exe
          "C:\Users\Admin\AppData\Roaming\Download\884050.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2724
          • C:\Users\Admin\AppData\Roaming\Download\884050.exe
            "C:\Users\Admin\AppData\Roaming\Download\884050.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5768
        • C:\Users\Admin\AppData\Roaming\Download\115471.exe
          "C:\Users\Admin\AppData\Roaming\Download\115471.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2332
          • C:\Users\Admin\AppData\Roaming\Download\115471.exe
            "C:\Users\Admin\AppData\Roaming\Download\115471.exe"
            5⤵
            • Executes dropped EXE
            PID:5480
        • C:\Users\Admin\AppData\Roaming\Download\817981.exe
          "C:\Users\Admin\AppData\Roaming\Download\817981.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6024
          • C:\Users\Admin\AppData\Roaming\Download\817981.exe
            "C:\Users\Admin\AppData\Roaming\Download\817981.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4512
        • C:\Users\Admin\AppData\Roaming\Download\414337.exe
          "C:\Users\Admin\AppData\Roaming\Download\414337.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1420
          • C:\Users\Admin\AppData\Roaming\Download\414337.exe
            "C:\Users\Admin\AppData\Roaming\Download\414337.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4636
        • C:\Users\Admin\AppData\Roaming\Download\364294.exe
          "C:\Users\Admin\AppData\Roaming\Download\364294.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4648
          • C:\Users\Admin\AppData\Roaming\Download\364294.exe
            "C:\Users\Admin\AppData\Roaming\Download\364294.exe"
            5⤵
            • Executes dropped EXE
            PID:2716
        • C:\Users\Admin\AppData\Roaming\Download\336271.exe
          "C:\Users\Admin\AppData\Roaming\Download\336271.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5244
          • C:\Users\Admin\AppData\Roaming\Download\336271.exe
            "C:\Users\Admin\AppData\Roaming\Download\336271.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1492
        • C:\Users\Admin\AppData\Roaming\Download\734875.exe
          "C:\Users\Admin\AppData\Roaming\Download\734875.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5432
          • C:\Users\Admin\AppData\Roaming\Download\734875.exe
            "C:\Users\Admin\AppData\Roaming\Download\734875.exe"
            5⤵
            • Executes dropped EXE
            PID:4400
        • C:\Users\Admin\AppData\Roaming\Download\332221.exe
          "C:\Users\Admin\AppData\Roaming\Download\332221.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:936
          • C:\Users\Admin\AppData\Roaming\Download\332221.exe
            "C:\Users\Admin\AppData\Roaming\Download\332221.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4136
        • C:\Users\Admin\AppData\Roaming\Download\033850.exe
          "C:\Users\Admin\AppData\Roaming\Download\033850.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5952
          • C:\Users\Admin\AppData\Roaming\Download\033850.exe
            "C:\Users\Admin\AppData\Roaming\Download\033850.exe"
            5⤵
            • Executes dropped EXE
            PID:5328
        • C:\Users\Admin\AppData\Roaming\Download\885719.exe
          "C:\Users\Admin\AppData\Roaming\Download\885719.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4636
          • C:\Users\Admin\AppData\Roaming\Download\885719.exe
            "C:\Users\Admin\AppData\Roaming\Download\885719.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4904
        • C:\Users\Admin\AppData\Roaming\Download\510134.exe
          "C:\Users\Admin\AppData\Roaming\Download\510134.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2272
          • C:\Users\Admin\AppData\Roaming\Download\510134.exe
            "C:\Users\Admin\AppData\Roaming\Download\510134.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5032
        • C:\Users\Admin\AppData\Roaming\Download\459405.exe
          "C:\Users\Admin\AppData\Roaming\Download\459405.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3180
          • C:\Users\Admin\AppData\Roaming\Download\459405.exe
            "C:\Users\Admin\AppData\Roaming\Download\459405.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5948
        • C:\Users\Admin\AppData\Roaming\Download\618204.exe
          "C:\Users\Admin\AppData\Roaming\Download\618204.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3456
          • C:\Users\Admin\AppData\Roaming\Download\618204.exe
            "C:\Users\Admin\AppData\Roaming\Download\618204.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2532
        • C:\Users\Admin\AppData\Roaming\Download\251448.exe
          "C:\Users\Admin\AppData\Roaming\Download\251448.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4176
          • C:\Users\Admin\AppData\Roaming\Download\251448.exe
            "C:\Users\Admin\AppData\Roaming\Download\251448.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4180
        • C:\Users\Admin\AppData\Roaming\Download\755959.exe
          "C:\Users\Admin\AppData\Roaming\Download\755959.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5564
          • C:\Users\Admin\AppData\Roaming\Download\755959.exe
            "C:\Users\Admin\AppData\Roaming\Download\755959.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5028
        • C:\Users\Admin\AppData\Roaming\Download\049226.exe
          "C:\Users\Admin\AppData\Roaming\Download\049226.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3668
          • C:\Users\Admin\AppData\Roaming\Download\049226.exe
            "C:\Users\Admin\AppData\Roaming\Download\049226.exe"
            5⤵
              PID:572
          • C:\Users\Admin\AppData\Roaming\Download\430939.exe
            "C:\Users\Admin\AppData\Roaming\Download\430939.exe" /Shorttailedrestart
            4⤵
              PID:5036
              • C:\Users\Admin\AppData\Roaming\Download\430939.exe
                "C:\Users\Admin\AppData\Roaming\Download\430939.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1872
            • C:\Users\Admin\AppData\Roaming\Download\720643.exe
              "C:\Users\Admin\AppData\Roaming\Download\720643.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4440
              • C:\Users\Admin\AppData\Roaming\Download\720643.exe
                "C:\Users\Admin\AppData\Roaming\Download\720643.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2124
            • C:\Users\Admin\AppData\Roaming\Download\422174.exe
              "C:\Users\Admin\AppData\Roaming\Download\422174.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1364
              • C:\Users\Admin\AppData\Roaming\Download\422174.exe
                "C:\Users\Admin\AppData\Roaming\Download\422174.exe"
                5⤵
                  PID:4344
              • C:\Users\Admin\AppData\Roaming\Download\823876.exe
                "C:\Users\Admin\AppData\Roaming\Download\823876.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1320
                • C:\Users\Admin\AppData\Roaming\Download\823876.exe
                  "C:\Users\Admin\AppData\Roaming\Download\823876.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4180
              • C:\Users\Admin\AppData\Roaming\Download\285582.exe
                "C:\Users\Admin\AppData\Roaming\Download\285582.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2980
                • C:\Users\Admin\AppData\Roaming\Download\285582.exe
                  "C:\Users\Admin\AppData\Roaming\Download\285582.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:5388
              • C:\Users\Admin\AppData\Roaming\Download\531562.exe
                "C:\Users\Admin\AppData\Roaming\Download\531562.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4700
                • C:\Users\Admin\AppData\Roaming\Download\531562.exe
                  "C:\Users\Admin\AppData\Roaming\Download\531562.exe"
                  5⤵
                    PID:2908
                • C:\Users\Admin\AppData\Roaming\Download\921286.exe
                  "C:\Users\Admin\AppData\Roaming\Download\921286.exe" /Shorttailedrestart
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4144
                  • C:\Users\Admin\AppData\Roaming\Download\921286.exe
                    "C:\Users\Admin\AppData\Roaming\Download\921286.exe"
                    5⤵
                      PID:2976
                  • C:\Users\Admin\AppData\Roaming\Download\390891.exe
                    "C:\Users\Admin\AppData\Roaming\Download\390891.exe" /Shorttailedrestart
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3672
                    • C:\Users\Admin\AppData\Roaming\Download\390891.exe
                      "C:\Users\Admin\AppData\Roaming\Download\390891.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4792
                  • C:\Users\Admin\AppData\Roaming\Download\890505.exe
                    "C:\Users\Admin\AppData\Roaming\Download\890505.exe" /Shorttailedrestart
                    4⤵
                      PID:4820
                      • C:\Users\Admin\AppData\Roaming\Download\890505.exe
                        "C:\Users\Admin\AppData\Roaming\Download\890505.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5660
                    • C:\Users\Admin\AppData\Roaming\Download\046767.exe
                      "C:\Users\Admin\AppData\Roaming\Download\046767.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4208
                      • C:\Users\Admin\AppData\Roaming\Download\046767.exe
                        "C:\Users\Admin\AppData\Roaming\Download\046767.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4544
                    • C:\Users\Admin\AppData\Roaming\Download\295565.exe
                      "C:\Users\Admin\AppData\Roaming\Download\295565.exe" /Shorttailedrestart
                      4⤵
                        PID:5588
                        • C:\Users\Admin\AppData\Roaming\Download\295565.exe
                          "C:\Users\Admin\AppData\Roaming\Download\295565.exe"
                          5⤵
                            PID:3132
                        • C:\Users\Admin\AppData\Roaming\Download\831901.exe
                          "C:\Users\Admin\AppData\Roaming\Download\831901.exe" /Shorttailedrestart
                          4⤵
                            PID:2876
                            • C:\Users\Admin\AppData\Roaming\Download\831901.exe
                              "C:\Users\Admin\AppData\Roaming\Download\831901.exe"
                              5⤵
                                PID:1388
                            • C:\Users\Admin\AppData\Roaming\Download\388708.exe
                              "C:\Users\Admin\AppData\Roaming\Download\388708.exe" /Shorttailedrestart
                              4⤵
                                PID:4224
                                • C:\Users\Admin\AppData\Roaming\Download\388708.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\388708.exe"
                                  5⤵
                                    PID:4616
                                • C:\Users\Admin\AppData\Roaming\Download\271039.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\271039.exe" /Shorttailedrestart
                                  4⤵
                                    PID:3344
                                    • C:\Users\Admin\AppData\Roaming\Download\271039.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\271039.exe"
                                      5⤵
                                        PID:2032
                                    • C:\Users\Admin\AppData\Roaming\Download\701588.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\701588.exe" /Shorttailedrestart
                                      4⤵
                                        PID:4388
                                        • C:\Users\Admin\AppData\Roaming\Download\701588.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\701588.exe"
                                          5⤵
                                            PID:3280
                                        • C:\Users\Admin\AppData\Roaming\Download\250367.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\250367.exe" /Shorttailedrestart
                                          4⤵
                                            PID:3200
                                            • C:\Users\Admin\AppData\Roaming\Download\250367.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\250367.exe"
                                              5⤵
                                                PID:712
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                          2⤵
                                          • Drops file in Windows directory
                                          • Enumerates system info in registry
                                          • Modifies registry class
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of WriteProcessMemory
                                          PID:1920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8a19bc188,0x7ff8a19bc194,0x7ff8a19bc1a0
                                            3⤵
                                              PID:1996
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,2035402759410063173,13851016904305376648,262144 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
                                              3⤵
                                                PID:4968
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,5110114953795520103,2224389972150846662,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:11
                                                3⤵
                                                • System Time Discovery
                                                PID:3336
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,3444081094368480503,2039352457478786690,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
                                                3⤵
                                                  PID:3896
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3480023615062405504,8929355146708306784,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                                                  3⤵
                                                    PID:1244
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6205757481484951366,5108260928987525287,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                                                    3⤵
                                                      PID:2044
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12608235411896762011,8931913371798927509,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
                                                      3⤵
                                                        PID:4996
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16209288875141065434,10642336616434306945,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
                                                        3⤵
                                                          PID:2412
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17635173278683736887,13089720471558145791,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                                                          3⤵
                                                            PID:5836
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3552,i,10780787850924554288,5825705068331196835,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:1
                                                            3⤵
                                                              PID:2812
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1027087275973607298,1564285899368054260,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
                                                              3⤵
                                                                PID:5468
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,16455108337457863569,16838986168880013974,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
                                                                3⤵
                                                                  PID:4964
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,1099534530418477755,730110291733358057,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
                                                                  3⤵
                                                                  • Modifies registry class
                                                                  PID:2688
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13785021604469470666,8973787316180655800,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:12
                                                                  3⤵
                                                                    PID:3780
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6652,i,5820157536288060165,16828333538453474334,2097152 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
                                                                    3⤵
                                                                      PID:2512
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17856209606867240410,6568844303211392310,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                                                                      3⤵
                                                                        PID:6088
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17856209606867240410,6568844303211392310,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                                                                        3⤵
                                                                          PID:3872
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,14255235988946616067,10036350173903724590,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
                                                                          3⤵
                                                                            PID:1828
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,2376138485757831897,6180033242715839983,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14
                                                                            3⤵
                                                                              PID:2332
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,3995283522521832455,125924354722216800,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                                              3⤵
                                                                                PID:4696
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,11328289886175970152,9796142928888033923,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                                                                                3⤵
                                                                                  PID:616
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,917858489045286272,7189606353434738237,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
                                                                                  3⤵
                                                                                    PID:5320
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3733104091561587885,2122397055873608410,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
                                                                                    3⤵
                                                                                      PID:3532
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,12578309665055199149,6384630735486655036,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
                                                                                      3⤵
                                                                                        PID:2532
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,8512991000977851906,11124069947401713063,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
                                                                                        3⤵
                                                                                          PID:4220
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,9512295983173399464,11619749824258716769,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
                                                                                          3⤵
                                                                                            PID:4016
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4976,i,1933222475584188182,3350845546326464002,262144 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:10
                                                                                            3⤵
                                                                                              PID:1408
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,1537961532534522273,1222449322290030106,524288 --field-trial-handle=2292,i,14558423458012814636,16041429533609931599,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
                                                                                              3⤵
                                                                                                PID:2124
                                                                                            • C:\Windows\explorer.exe
                                                                                              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                              2⤵
                                                                                                PID:2352
                                                                                            • C:\Windows\explorer.exe
                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2504
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:4928
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:2672
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                1⤵
                                                                                                  PID:3204
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                  1⤵
                                                                                                    PID:5068

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        DouTuDaShi.exe
                                                                                                        • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                        • Size 1.1MB
                                                                                                        • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        96f9b4f9adf74a24_0
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                        • Size 213B
                                                                                                        • SHA256 a9061409f7a164ffd856095fe7ceb196e421064f4dc4861372dbcb10e01fee4f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                        • Size 4KB
                                                                                                        • SHA256 77877003db1f6ac20e50fbcaec134e28b206db4a98e63ea24104cf5c5b2fd414
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index~RFe5a41fc.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a41fc.TMP
                                                                                                        • Size 3KB
                                                                                                        • SHA256 4427400e53a3ad132ce9831b80fc300e341e2b8399c8f4812e8063104524278b
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        SiteList-Enterprise.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                        • Size 2B
                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Edge Profile.ico
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                        • Size 70KB
                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Network Persistent State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                        • Size 7KB
                                                                                                        • SHA256 70635722da15733e01c6905b048efd2e644709e2704fe592c0395612e60adfd4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        SCT Auditing Pending Reports
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                        • Size 2B
                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Sdch Dictionaries
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                        • Size 40B
                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 12KB
                                                                                                        • SHA256 2e994643cda9e8bcdb66056078d87eccde97c9ba94e09044ecf47ac877aeb12c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 12KB
                                                                                                        • SHA256 726944219aacc1840b58ca6355530bce2ccf5ee17d17fe7e4e071205032df3c0
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 12KB
                                                                                                        • SHA256 5786b0ecc5445c4bb5348a8cd5ffc8e2992f5693c9fc4bc23ed6db5fd73ed372
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Secure Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                        • Size 27KB
                                                                                                        • SHA256 8ecf3bfbda7d083ee14065076afd54a4cc11d8843d6265cc3ef61ab7d184849c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        OperationConfig
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                        • Size 22KB
                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        OperationConfig~RFe5a851f.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a851f.TMP
                                                                                                        • Size 3KB
                                                                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 34KB
                                                                                                        • SHA256 f64a799e53d7fba9b25d8d05af9f53ea011cadd0f9e6759ecbafe5e1f9fe5d00
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 34KB
                                                                                                        • SHA256 d4fe352d1de8878f59a657d228b3a4e765f27a46971849969e722e904fac42b1
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 37KB
                                                                                                        • SHA256 ad837addf86f8e70e390bd729f73242acafd98f3e9f3edec41ef59615c65d032
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 37KB
                                                                                                        • SHA256 64fd143862c91ed5c33f2d96a0975579576e8281c2c5c55b50c56af5b6415cca
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 38KB
                                                                                                        • SHA256 1ebe8f4edad85503cd4b124a4a3afbcd7d88354bd7c33545364c864e79bf6fd2
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 252B
                                                                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 372B
                                                                                                        • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 132B
                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                        • Size 13B
                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        hao.360[1].xml
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\USTI4K39\hao.360[1].xml
                                                                                                        • Size 50KB
                                                                                                        • SHA256 a8afb454b00e90c5aef5426da36ee6df4cde334877c79893b56936e4345cbbbd
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        hao.360[1].xml
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\USTI4K39\hao.360[1].xml
                                                                                                        • Size 55KB
                                                                                                        • SHA256 e801f925112490dc40c83dcff7332ba24157c2918747e8a45f597eae12fda441
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        0[1].png
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\40Z8XPWM\0[1].png
                                                                                                        • Size 574B
                                                                                                        • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        113[1].js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\113[1].js
                                                                                                        • Size 61KB
                                                                                                        • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        sed_api_weather_info[1].htm
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\sed_api_weather_info[1].htm
                                                                                                        • Size 8KB
                                                                                                        • SHA256 9975ce2f59aa37fa35e415039eea03f8cff4128848ec9882c5c00bb5f48ba6bd
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        time[1].js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\time[1].js
                                                                                                        • Size 27B
                                                                                                        • SHA256 e89cb19b7a8104fc05b8420371393c34631907d0f2bda81226d8adb77bfce6ec
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        ldsajdklsajdlkjsalkda.bat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                        • Size 589B
                                                                                                        • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        nubcle.exe
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nubcle.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 29369076a9c32dbbeca01224e74e09fbb4da57be689350f41ccb5716ecc2f957
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        content_new.js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1920_1524642441\CRX_INSTALL\content_new.js
                                                                                                        • Size 10KB
                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        164650.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\164650.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 fe17aff49664a3d4d86efc3cf07d20a63b091b0bec40498f6cae38de33f41ba5
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        360064.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\360064.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 892e332a1632ed18bec4cfc2db25709d7020e7b4f69455bddf62af54f2fa9994
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        397743.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\397743.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 b373b3ad6eb387a8548167601e18b7c355af66be416ed0ce1953d201882b4b39
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        544181.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\544181.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 80c3c3a6d1a764e60a6bcb3a9b33878d7e21e7e20e0b87007198e93e2bc451f3
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        547653.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\547653.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 8bad0d60de20980baab2de7eabccd9932f0e52ff1707d2bc90bd661d426d6dbc
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        580690.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\580690.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 f9dd6c13bb1e2eea08624339280eefb08f7497bf8563931c9ee7794c321ce396
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        627640.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\627640.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 384fdd5db59f1b730cc1036a9e9740d982fb4501aae4d91dd9f931afaf8c86b4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        847611.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\847611.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 084222caa6739517048ec875ea935797c0bd4a4dedb02517f99b106250df9515
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        848864.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\848864.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 5771f177eaa14bb57818cdd518021ff464fe95aee20b40118b85d5792cb7d242
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        874966.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\874966.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 d391848a9eaca7ab05413b8b864ce595af0b02b444fe4e5528e3256bf6e8dabb
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        899272.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\899272.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 0bc6461397c4b2dd5c70b56dc631f5c903831976d1a0eb1dd0417f6c4de71e06
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        924119.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\924119.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 b2071ea734e05ffde991543a30c7e28fde10cc1e8b282786d1b6561a3ce3364a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        944454.exe
                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Download\944454.exe
                                                                                                        • Size 1.5MB
                                                                                                        • SHA256 ed814d3f34252e265ffcc244139cf5c962ae955386cf8f21059d0d1c2b49d91a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        memory/124-19-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1078-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-239-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1023-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1123-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1168-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-698-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1213-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1258-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-827-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1304-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/352-1333-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5824-122-0x000000000FB70000-0x000000000FC70000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6072-131-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                        Download