Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_ef14870199049874f4adbf7e51ccd1a2_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260930-sm18msvxc1
  • SHA256 abc97c1e98393e398a2b04559e9b420a904c78b39649c415c74fde6ebafc5ec6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_ef14870199049874f4adbf7e51ccd1a2_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_ef14870199049874f4adbf7e51ccd1a2_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5284
    • C:\Users\Admin\AppData\Local\Temp\djriwv.exe
      "C:\Users\Admin\AppData\Local\Temp\djriwv.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Users\Admin\AppData\Local\Temp\djriwv.exe
        "C:\Users\Admin\AppData\Local\Temp\djriwv.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Users\Admin\AppData\Roaming\Download\693852.exe
          "C:\Users\Admin\AppData\Roaming\Download\693852.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:792
          • C:\Users\Admin\AppData\Roaming\Download\693852.exe
            "C:\Users\Admin\AppData\Roaming\Download\693852.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5972
        • C:\Users\Admin\AppData\Roaming\Download\883257.exe
          "C:\Users\Admin\AppData\Roaming\Download\883257.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5608
          • C:\Users\Admin\AppData\Roaming\Download\883257.exe
            "C:\Users\Admin\AppData\Roaming\Download\883257.exe"
            5⤵
            • Executes dropped EXE
            PID:4700
        • C:\Users\Admin\AppData\Roaming\Download\377788.exe
          "C:\Users\Admin\AppData\Roaming\Download\377788.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:256
          • C:\Users\Admin\AppData\Roaming\Download\377788.exe
            "C:\Users\Admin\AppData\Roaming\Download\377788.exe"
            5⤵
            • Executes dropped EXE
            PID:2772
        • C:\Users\Admin\AppData\Roaming\Download\488470.exe
          "C:\Users\Admin\AppData\Roaming\Download\488470.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Users\Admin\AppData\Roaming\Download\488470.exe
            "C:\Users\Admin\AppData\Roaming\Download\488470.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3092
        • C:\Users\Admin\AppData\Roaming\Download\747557.exe
          "C:\Users\Admin\AppData\Roaming\Download\747557.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:716
          • C:\Users\Admin\AppData\Roaming\Download\747557.exe
            "C:\Users\Admin\AppData\Roaming\Download\747557.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3828
        • C:\Users\Admin\AppData\Roaming\Download\996356.exe
          "C:\Users\Admin\AppData\Roaming\Download\996356.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6084
          • C:\Users\Admin\AppData\Roaming\Download\996356.exe
            "C:\Users\Admin\AppData\Roaming\Download\996356.exe"
            5⤵
            • Executes dropped EXE
            PID:5152
        • C:\Users\Admin\AppData\Roaming\Download\730592.exe
          "C:\Users\Admin\AppData\Roaming\Download\730592.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Users\Admin\AppData\Roaming\Download\730592.exe
            "C:\Users\Admin\AppData\Roaming\Download\730592.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2512
        • C:\Users\Admin\AppData\Roaming\Download\447928.exe
          "C:\Users\Admin\AppData\Roaming\Download\447928.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Users\Admin\AppData\Roaming\Download\447928.exe
            "C:\Users\Admin\AppData\Roaming\Download\447928.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4208
        • C:\Users\Admin\AppData\Roaming\Download\696825.exe
          "C:\Users\Admin\AppData\Roaming\Download\696825.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Users\Admin\AppData\Roaming\Download\696825.exe
            "C:\Users\Admin\AppData\Roaming\Download\696825.exe"
            5⤵
            • Executes dropped EXE
            PID:4772
        • C:\Users\Admin\AppData\Roaming\Download\439171.exe
          "C:\Users\Admin\AppData\Roaming\Download\439171.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3572
          • C:\Users\Admin\AppData\Roaming\Download\439171.exe
            "C:\Users\Admin\AppData\Roaming\Download\439171.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1984
        • C:\Users\Admin\AppData\Roaming\Download\798060.exe
          "C:\Users\Admin\AppData\Roaming\Download\798060.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:852
          • C:\Users\Admin\AppData\Roaming\Download\798060.exe
            "C:\Users\Admin\AppData\Roaming\Download\798060.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5652
        • C:\Users\Admin\AppData\Roaming\Download\027847.exe
          "C:\Users\Admin\AppData\Roaming\Download\027847.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5600
          • C:\Users\Admin\AppData\Roaming\Download\027847.exe
            "C:\Users\Admin\AppData\Roaming\Download\027847.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6032
        • C:\Users\Admin\AppData\Roaming\Download\882293.exe
          "C:\Users\Admin\AppData\Roaming\Download\882293.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1656
          • C:\Users\Admin\AppData\Roaming\Download\882293.exe
            "C:\Users\Admin\AppData\Roaming\Download\882293.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5556
        • C:\Users\Admin\AppData\Roaming\Download\488648.exe
          "C:\Users\Admin\AppData\Roaming\Download\488648.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:120
          • C:\Users\Admin\AppData\Roaming\Download\488648.exe
            "C:\Users\Admin\AppData\Roaming\Download\488648.exe"
            5⤵
            • Executes dropped EXE
            PID:3160
        • C:\Users\Admin\AppData\Roaming\Download\655436.exe
          "C:\Users\Admin\AppData\Roaming\Download\655436.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4624
          • C:\Users\Admin\AppData\Roaming\Download\655436.exe
            "C:\Users\Admin\AppData\Roaming\Download\655436.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3256
        • C:\Users\Admin\AppData\Roaming\Download\340046.exe
          "C:\Users\Admin\AppData\Roaming\Download\340046.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2932
          • C:\Users\Admin\AppData\Roaming\Download\340046.exe
            "C:\Users\Admin\AppData\Roaming\Download\340046.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1828
        • C:\Users\Admin\AppData\Roaming\Download\332741.exe
          "C:\Users\Admin\AppData\Roaming\Download\332741.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3768
          • C:\Users\Admin\AppData\Roaming\Download\332741.exe
            "C:\Users\Admin\AppData\Roaming\Download\332741.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6088
        • C:\Users\Admin\AppData\Roaming\Download\581628.exe
          "C:\Users\Admin\AppData\Roaming\Download\581628.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5376
          • C:\Users\Admin\AppData\Roaming\Download\581628.exe
            "C:\Users\Admin\AppData\Roaming\Download\581628.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3624
        • C:\Users\Admin\AppData\Roaming\Download\981232.exe
          "C:\Users\Admin\AppData\Roaming\Download\981232.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3472
          • C:\Users\Admin\AppData\Roaming\Download\981232.exe
            "C:\Users\Admin\AppData\Roaming\Download\981232.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4252
        • C:\Users\Admin\AppData\Roaming\Download\430139.exe
          "C:\Users\Admin\AppData\Roaming\Download\430139.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3440
          • C:\Users\Admin\AppData\Roaming\Download\430139.exe
            "C:\Users\Admin\AppData\Roaming\Download\430139.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:896
        • C:\Users\Admin\AppData\Roaming\Download\074475.exe
          "C:\Users\Admin\AppData\Roaming\Download\074475.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3208
          • C:\Users\Admin\AppData\Roaming\Download\074475.exe
            "C:\Users\Admin\AppData\Roaming\Download\074475.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2492
        • C:\Users\Admin\AppData\Roaming\Download\109658.exe
          "C:\Users\Admin\AppData\Roaming\Download\109658.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4680
          • C:\Users\Admin\AppData\Roaming\Download\109658.exe
            "C:\Users\Admin\AppData\Roaming\Download\109658.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3492
        • C:\Users\Admin\AppData\Roaming\Download\659537.exe
          "C:\Users\Admin\AppData\Roaming\Download\659537.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1880
          • C:\Users\Admin\AppData\Roaming\Download\659537.exe
            "C:\Users\Admin\AppData\Roaming\Download\659537.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1164
        • C:\Users\Admin\AppData\Roaming\Download\704417.exe
          "C:\Users\Admin\AppData\Roaming\Download\704417.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5628
          • C:\Users\Admin\AppData\Roaming\Download\704417.exe
            "C:\Users\Admin\AppData\Roaming\Download\704417.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5332
        • C:\Users\Admin\AppData\Roaming\Download\105132.exe
          "C:\Users\Admin\AppData\Roaming\Download\105132.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4456
          • C:\Users\Admin\AppData\Roaming\Download\105132.exe
            "C:\Users\Admin\AppData\Roaming\Download\105132.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1452
        • C:\Users\Admin\AppData\Roaming\Download\897663.exe
          "C:\Users\Admin\AppData\Roaming\Download\897663.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5396
          • C:\Users\Admin\AppData\Roaming\Download\897663.exe
            "C:\Users\Admin\AppData\Roaming\Download\897663.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5260
        • C:\Users\Admin\AppData\Roaming\Download\297375.exe
          "C:\Users\Admin\AppData\Roaming\Download\297375.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3184
          • C:\Users\Admin\AppData\Roaming\Download\297375.exe
            "C:\Users\Admin\AppData\Roaming\Download\297375.exe"
            5⤵
            • Executes dropped EXE
            PID:3236
        • C:\Users\Admin\AppData\Roaming\Download\426154.exe
          "C:\Users\Admin\AppData\Roaming\Download\426154.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1072
          • C:\Users\Admin\AppData\Roaming\Download\426154.exe
            "C:\Users\Admin\AppData\Roaming\Download\426154.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4104
        • C:\Users\Admin\AppData\Roaming\Download\027868.exe
          "C:\Users\Admin\AppData\Roaming\Download\027868.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5540
          • C:\Users\Admin\AppData\Roaming\Download\027868.exe
            "C:\Users\Admin\AppData\Roaming\Download\027868.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5960
        • C:\Users\Admin\AppData\Roaming\Download\376765.exe
          "C:\Users\Admin\AppData\Roaming\Download\376765.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1112
          • C:\Users\Admin\AppData\Roaming\Download\376765.exe
            "C:\Users\Admin\AppData\Roaming\Download\376765.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3664
        • C:\Users\Admin\AppData\Roaming\Download\870296.exe
          "C:\Users\Admin\AppData\Roaming\Download\870296.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1788
          • C:\Users\Admin\AppData\Roaming\Download\870296.exe
            "C:\Users\Admin\AppData\Roaming\Download\870296.exe"
            5⤵
              PID:4580
          • C:\Users\Admin\AppData\Roaming\Download\168900.exe
            "C:\Users\Admin\AppData\Roaming\Download\168900.exe" /Shorttailedrestart
            4⤵
              PID:4804
              • C:\Users\Admin\AppData\Roaming\Download\168900.exe
                "C:\Users\Admin\AppData\Roaming\Download\168900.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4164
            • C:\Users\Admin\AppData\Roaming\Download\862419.exe
              "C:\Users\Admin\AppData\Roaming\Download\862419.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3044
              • C:\Users\Admin\AppData\Roaming\Download\862419.exe
                "C:\Users\Admin\AppData\Roaming\Download\862419.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3400
            • C:\Users\Admin\AppData\Roaming\Download\018492.exe
              "C:\Users\Admin\AppData\Roaming\Download\018492.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3564
              • C:\Users\Admin\AppData\Roaming\Download\018492.exe
                "C:\Users\Admin\AppData\Roaming\Download\018492.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2980
            • C:\Users\Admin\AppData\Roaming\Download\277499.exe
              "C:\Users\Admin\AppData\Roaming\Download\277499.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3216
              • C:\Users\Admin\AppData\Roaming\Download\277499.exe
                "C:\Users\Admin\AppData\Roaming\Download\277499.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3912
            • C:\Users\Admin\AppData\Roaming\Download\788468.exe
              "C:\Users\Admin\AppData\Roaming\Download\788468.exe" /Shorttailedrestart
              4⤵
                PID:1692
                • C:\Users\Admin\AppData\Roaming\Download\788468.exe
                  "C:\Users\Admin\AppData\Roaming\Download\788468.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4408
              • C:\Users\Admin\AppData\Roaming\Download\550525.exe
                "C:\Users\Admin\AppData\Roaming\Download\550525.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5972
                • C:\Users\Admin\AppData\Roaming\Download\550525.exe
                  "C:\Users\Admin\AppData\Roaming\Download\550525.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4156
              • C:\Users\Admin\AppData\Roaming\Download\606408.exe
                "C:\Users\Admin\AppData\Roaming\Download\606408.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4104
                • C:\Users\Admin\AppData\Roaming\Download\606408.exe
                  "C:\Users\Admin\AppData\Roaming\Download\606408.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2508
              • C:\Users\Admin\AppData\Roaming\Download\308037.exe
                "C:\Users\Admin\AppData\Roaming\Download\308037.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2936
                • C:\Users\Admin\AppData\Roaming\Download\308037.exe
                  "C:\Users\Admin\AppData\Roaming\Download\308037.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:6112
              • C:\Users\Admin\AppData\Roaming\Download\778641.exe
                "C:\Users\Admin\AppData\Roaming\Download\778641.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3516
                • C:\Users\Admin\AppData\Roaming\Download\778641.exe
                  "C:\Users\Admin\AppData\Roaming\Download\778641.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4492
              • C:\Users\Admin\AppData\Roaming\Download\028520.exe
                "C:\Users\Admin\AppData\Roaming\Download\028520.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4408
                • C:\Users\Admin\AppData\Roaming\Download\028520.exe
                  "C:\Users\Admin\AppData\Roaming\Download\028520.exe"
                  5⤵
                    PID:4512
                • C:\Users\Admin\AppData\Roaming\Download\528234.exe
                  "C:\Users\Admin\AppData\Roaming\Download\528234.exe" /Shorttailedrestart
                  4⤵
                    PID:1876
                    • C:\Users\Admin\AppData\Roaming\Download\528234.exe
                      "C:\Users\Admin\AppData\Roaming\Download\528234.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:2384
                  • C:\Users\Admin\AppData\Roaming\Download\877031.exe
                    "C:\Users\Admin\AppData\Roaming\Download\877031.exe" /Shorttailedrestart
                    4⤵
                      PID:5332
                      • C:\Users\Admin\AppData\Roaming\Download\877031.exe
                        "C:\Users\Admin\AppData\Roaming\Download\877031.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:2636
                    • C:\Users\Admin\AppData\Roaming\Download\868934.exe
                      "C:\Users\Admin\AppData\Roaming\Download\868934.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3352
                      • C:\Users\Admin\AppData\Roaming\Download\868934.exe
                        "C:\Users\Admin\AppData\Roaming\Download\868934.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5876
                    • C:\Users\Admin\AppData\Roaming\Download\114916.exe
                      "C:\Users\Admin\AppData\Roaming\Download\114916.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4708
                      • C:\Users\Admin\AppData\Roaming\Download\114916.exe
                        "C:\Users\Admin\AppData\Roaming\Download\114916.exe"
                        5⤵
                          PID:1032
                      • C:\Users\Admin\AppData\Roaming\Download\463895.exe
                        "C:\Users\Admin\AppData\Roaming\Download\463895.exe" /Shorttailedrestart
                        4⤵
                          PID:4820
                          • C:\Users\Admin\AppData\Roaming\Download\463895.exe
                            "C:\Users\Admin\AppData\Roaming\Download\463895.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4688
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                      2⤵
                      • Drops file in Windows directory
                      • Enumerates system info in registry
                      • Modifies registry class
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3360
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x37c,0x7ffbf49ac188,0x7ffbf49ac194,0x7ffbf49ac1a0
                        3⤵
                          PID:2208
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,4275239201049210970,10883804913457624466,262144 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:2
                          3⤵
                            PID:3388
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,11868847421066899040,4055288385116922633,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:11
                            3⤵
                            • System Time Discovery
                            PID:3340
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,11271704721043971877,17832336451057689837,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:13
                            3⤵
                              PID:2260
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,797546136649523697,13366247437499752702,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
                              3⤵
                                PID:1968
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,6588381773312874093,2492331473604052420,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
                                3⤵
                                  PID:1404
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17930617630269202924,4571854378769141428,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
                                  3⤵
                                    PID:2476
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10707053958751529789,10830549690348074876,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:9
                                    3⤵
                                      PID:2736
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11076965125751125688,13716018367928038686,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
                                      3⤵
                                        PID:6140
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5488,i,1202540408837349843,2623411852104592895,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
                                        3⤵
                                          PID:1424
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,16859189425676570704,10878442625507287667,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
                                          3⤵
                                            PID:4512
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,12073026396817301312,16191638587075890353,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
                                            3⤵
                                              PID:1692
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16000021248166346218,5715858448059428813,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                              3⤵
                                                PID:2952
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16000021248166346218,5715858448059428813,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                                3⤵
                                                  PID:2928
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16970832667079307321,5986331096121336116,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                                  3⤵
                                                    PID:2508
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,10290731030778756422,18243480568572595365,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
                                                    3⤵
                                                      PID:1828
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6748393543724977022,11010822066977169445,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
                                                      3⤵
                                                        PID:3884
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,15562314130935950447,2373306752886600644,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
                                                        3⤵
                                                          PID:1788
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,4179264406887977930,9887029880894097579,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:14
                                                          3⤵
                                                            PID:4180
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,12506594241455021445,6773995728537029975,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
                                                            3⤵
                                                              PID:2328
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,4664324482541144031,12656140641337807297,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                                              3⤵
                                                              • Modifies registry class
                                                              PID:4476
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,13026213912361307090,18315666597601659544,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:12
                                                              3⤵
                                                                PID:5152
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,13641231769120046144,9308930287104601871,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
                                                                3⤵
                                                                  PID:5348
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,17423661173097399093,7683545314396426748,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
                                                                  3⤵
                                                                    PID:1828
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5528,i,17045624758354471427,17959140412227903150,2097152 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
                                                                    3⤵
                                                                      PID:6100
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,10344997971883819413,7169765940675114213,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
                                                                      3⤵
                                                                        PID:3784
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4964,i,15261607204654001695,16999708553578133243,262144 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:10
                                                                        3⤵
                                                                          PID:2996
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,5177112511447197884,14107966864208048945,524288 --field-trial-handle=2952,i,2954510868752474061,7687237589186140030,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:14
                                                                          3⤵
                                                                            PID:5916
                                                                        • C:\Windows\explorer.exe
                                                                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                          2⤵
                                                                            PID:5236
                                                                        • C:\Windows\explorer.exe
                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3536
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                            2⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:4128
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                          1⤵
                                                                            PID:4260
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                            1⤵
                                                                              PID:4904
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                              1⤵
                                                                                PID:3024

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    DouTuDaShi.exe
                                                                                    • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                    • Size 1.1MB
                                                                                    • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    BookmarkMergedSurfaceOrdering
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                    • Size 6B
                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    temp-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                    • Size 3KB
                                                                                    • SHA256 c2d102a8e4f4b452ea858ab4518b89a8ab741452c1f6afd6f0878fa47c713eae
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 2KB
                                                                                    • SHA256 6dfc3b9ec8fe3cd95ba2b5822f8bcdb23157be4650769aa7a0c5f0a58a2eb194
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 2KB
                                                                                    • SHA256 72347993fe8e4da6936d1dc6135dbfa98d2a638450570cd68c1aa70948a79205
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 3KB
                                                                                    • SHA256 87a5be00eaa8dbc03a7c4e5c5efbc53534b267494ba03338e92649ae4bb0902c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    SiteList-Enterprise.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                    • Size 2B
                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Edge Profile.ico
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                    • Size 70KB
                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 3KB
                                                                                    • SHA256 7883fa9845c08e5581b54950183fbc445a71abac7223e30b871ab2614d621d07
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 6KB
                                                                                    • SHA256 7f2b27ca4434b7af87ab1d3d19fa11429525177f15e62fd104ba59a508793058
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    SCT Auditing Pending Reports
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Sdch Dictionaries
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                    • Size 40B
                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 11KB
                                                                                    • SHA256 7f26aab30831a883e694cd74419fae9a74f07868a8720b41f3b56e66c6d6c45b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 11KB
                                                                                    • SHA256 56de21d130acae2bac00472fb10f4b72885ffbf412d4c70a9fee15e209f46579
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 12KB
                                                                                    • SHA256 b86d3e716d5c522329a88fb737abd191fd11a390d8213c55fa2fcb2e2cc21702
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Secure Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                    • Size 29KB
                                                                                    • SHA256 7e60a5aa9ef527ef1856906cd888a40fc4ac965aeb801e0c00bff5dc89634ded
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    sync_diagnostic.log
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                    • Size 4KB
                                                                                    • SHA256 6874879d8ca827ae55d162244b74cf952ae98e565ffdfa73015a357aedbf0e55
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    d9b19b8f-abbe-4587-be65-d6a89dd69c95.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d9b19b8f-abbe-4587-be65-d6a89dd69c95.tmp
                                                                                    • Size 22KB
                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 35KB
                                                                                    • SHA256 7237bed2cc9a9beb2705e7c6fdbb9f5ea060e8720d1aff457424b6994849ec9a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 43KB
                                                                                    • SHA256 eea25a24777a7209f469c6a4c5f2bb15d5e144cf768b98cc44d645598379f118
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 35KB
                                                                                    • SHA256 95cb1b3e39a2825d92b8771f08a5337f95d5ebd5c96b10acd193d640b6917d3e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    metadata.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                    • Size 252B
                                                                                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    metadata.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                    • Size 132B
                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    a7911740-8c2b-4b31-8ef5-99e99bb3e65a.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7911740-8c2b-4b31-8ef5-99e99bb3e65a.tmp
                                                                                    • Size 13B
                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    f3e5b7f2-e3dd-48e3-9c5b-2998f5b325a2.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3e5b7f2-e3dd-48e3-9c5b-2998f5b325a2.tmp
                                                                                    • Size 39KB
                                                                                    • SHA256 76ce30b8d785993b7aefde227e6ea61b8c9a0d366cc0b62c47f1b90fa2ddfe61
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    113[1].js
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\113[1].js
                                                                                    • Size 61KB
                                                                                    • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    0[1].png
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6HGNC2Z\0[1].png
                                                                                    • Size 574B
                                                                                    • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    djriwv.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\djriwv.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 abc97c1e98393e398a2b04559e9b420a904c78b39649c415c74fde6ebafc5ec6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ldsajdklsajdlkjsalkda.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                    • Size 589B
                                                                                    • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    content_new.js
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_955754533\CRX_INSTALL\content_new.js
                                                                                    • Size 10KB
                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    027847.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\027847.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 b71ba38738715d47e691870a4ee9e2a9cf225f492a2501fd49d8ac346b66aff8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    377788.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\377788.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 ccc02e08cfff42393234811035f27cc6ab6a207672d361478bcdaeba182e71d9
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    439171.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\439171.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 e788d9bc3a553e5f14396780ae79990ad6d7241761ef12c0f223d99ce91359f1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    447928.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\447928.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 a0aff0ec452a4497a5a0ed6204c1c8d3fc71845ab579e2aad5e7a7c1d9682073
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    488470.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\488470.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 56f7be0e2f920ec0377ff716416343e53d1bf15c75330bb1b3b37d05b4d4d056
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    488648.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\488648.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 758cee36741ba8f432605ff6b0f4e7e97e55dc22aa22a8df8512fa82c9d61cb8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    693852.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\693852.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 ffffef57f88307841a9de872ea8ba47a5acb27206a1bbe1b28bc4223b298361e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    696825.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\696825.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 05303d2ff3f692c8deea372fb8c543d86d78d2f3e895e365d599085575a2fd7a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    730592.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\730592.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 8b870cf58918209cbb6c0bb50d3dd71cfc826ae169fde0060c099e8cf96d0961
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    747557.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\747557.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 e596d4f828e7b0d77bf31c6941a927843554b88e1db98d87c527b4f276736d1e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    798060.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\798060.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 d0d8b7e968a5bd214a2f9e2fad2a9d095c84053302064311ce577efd82fe4613
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    882293.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\882293.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 91f9e4987419896c93f3ba72f8201f0cad1f17f3480ec07f794cd3d84bd5e770
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    883257.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\883257.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 16e160fe7abd4e6f18b7d9faf6cbec67caf51b07e9892b3baa2f404282ce95fb
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    996356.exe
                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\996356.exe
                                                                                    • Size 1.5MB
                                                                                    • SHA256 73bc30643ee36c34f82d4c7b4c076b743050c21ac34d241fdfaf9cbb8463e32a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    memory/3232-895-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-1019-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-779-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-676-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-961-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-527-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-749-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-829-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-1090-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-1170-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-279-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-1237-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-1268-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/3232-635-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download

                                                                                    memory/4248-139-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                    Download