Overview

overview

7

Static

static

3

2026-10-02...op.exe

windows10-2004-x64

7

2026-10-02...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 11:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_5f74952763a728a45dde662c568a0f3e_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261003-nr5dmsyycv
  • SHA256 3592d142cc5e50ac55bb36f9bb3e1cd27c436dfc4e8c0b1a223721bd99733b2f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_5f74952763a728a45dde662c568a0f3e_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_5f74952763a728a45dde662c568a0f3e_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\jatgfr.exe
      "C:\Users\Admin\AppData\Local\Temp\jatgfr.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Users\Admin\AppData\Local\Temp\jatgfr.exe
        "C:\Users\Admin\AppData\Local\Temp\jatgfr.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Users\Admin\AppData\Roaming\Download\735340.exe
          "C:\Users\Admin\AppData\Roaming\Download\735340.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Users\Admin\AppData\Roaming\Download\735340.exe
            "C:\Users\Admin\AppData\Roaming\Download\735340.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:260
        • C:\Users\Admin\AppData\Roaming\Download\629849.exe
          "C:\Users\Admin\AppData\Roaming\Download\629849.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4228
          • C:\Users\Admin\AppData\Roaming\Download\629849.exe
            "C:\Users\Admin\AppData\Roaming\Download\629849.exe"
            5⤵
            • Executes dropped EXE
            PID:2284
        • C:\Users\Admin\AppData\Roaming\Download\799727.exe
          "C:\Users\Admin\AppData\Roaming\Download\799727.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4652
          • C:\Users\Admin\AppData\Roaming\Download\799727.exe
            "C:\Users\Admin\AppData\Roaming\Download\799727.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5576
        • C:\Users\Admin\AppData\Roaming\Download\205396.exe
          "C:\Users\Admin\AppData\Roaming\Download\205396.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5988
          • C:\Users\Admin\AppData\Roaming\Download\205396.exe
            "C:\Users\Admin\AppData\Roaming\Download\205396.exe"
            5⤵
            • Executes dropped EXE
            PID:4128
        • C:\Users\Admin\AppData\Roaming\Download\467144.exe
          "C:\Users\Admin\AppData\Roaming\Download\467144.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Users\Admin\AppData\Roaming\Download\467144.exe
            "C:\Users\Admin\AppData\Roaming\Download\467144.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:692
        • C:\Users\Admin\AppData\Roaming\Download\920537.exe
          "C:\Users\Admin\AppData\Roaming\Download\920537.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Roaming\Download\920537.exe
            "C:\Users\Admin\AppData\Roaming\Download\920537.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3824
        • C:\Users\Admin\AppData\Roaming\Download\109132.exe
          "C:\Users\Admin\AppData\Roaming\Download\109132.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Users\Admin\AppData\Roaming\Download\109132.exe
            "C:\Users\Admin\AppData\Roaming\Download\109132.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5652
        • C:\Users\Admin\AppData\Roaming\Download\191824.exe
          "C:\Users\Admin\AppData\Roaming\Download\191824.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5892
          • C:\Users\Admin\AppData\Roaming\Download\191824.exe
            "C:\Users\Admin\AppData\Roaming\Download\191824.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3936
        • C:\Users\Admin\AppData\Roaming\Download\039539.exe
          "C:\Users\Admin\AppData\Roaming\Download\039539.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Users\Admin\AppData\Roaming\Download\039539.exe
            "C:\Users\Admin\AppData\Roaming\Download\039539.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3888
        • C:\Users\Admin\AppData\Roaming\Download\012213.exe
          "C:\Users\Admin\AppData\Roaming\Download\012213.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1604
          • C:\Users\Admin\AppData\Roaming\Download\012213.exe
            "C:\Users\Admin\AppData\Roaming\Download\012213.exe"
            5⤵
            • Executes dropped EXE
            PID:4436
        • C:\Users\Admin\AppData\Roaming\Download\514841.exe
          "C:\Users\Admin\AppData\Roaming\Download\514841.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:6060
          • C:\Users\Admin\AppData\Roaming\Download\514841.exe
            "C:\Users\Admin\AppData\Roaming\Download\514841.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1608
        • C:\Users\Admin\AppData\Roaming\Download\425194.exe
          "C:\Users\Admin\AppData\Roaming\Download\425194.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:872
          • C:\Users\Admin\AppData\Roaming\Download\425194.exe
            "C:\Users\Admin\AppData\Roaming\Download\425194.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4156
        • C:\Users\Admin\AppData\Roaming\Download\929604.exe
          "C:\Users\Admin\AppData\Roaming\Download\929604.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5984
          • C:\Users\Admin\AppData\Roaming\Download\929604.exe
            "C:\Users\Admin\AppData\Roaming\Download\929604.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3504
        • C:\Users\Admin\AppData\Roaming\Download\665765.exe
          "C:\Users\Admin\AppData\Roaming\Download\665765.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2620
          • C:\Users\Admin\AppData\Roaming\Download\665765.exe
            "C:\Users\Admin\AppData\Roaming\Download\665765.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1508
        • C:\Users\Admin\AppData\Roaming\Download\237489.exe
          "C:\Users\Admin\AppData\Roaming\Download\237489.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5088
          • C:\Users\Admin\AppData\Roaming\Download\237489.exe
            "C:\Users\Admin\AppData\Roaming\Download\237489.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3972
        • C:\Users\Admin\AppData\Roaming\Download\729990.exe
          "C:\Users\Admin\AppData\Roaming\Download\729990.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1036
          • C:\Users\Admin\AppData\Roaming\Download\729990.exe
            "C:\Users\Admin\AppData\Roaming\Download\729990.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2684
        • C:\Users\Admin\AppData\Roaming\Download\192957.exe
          "C:\Users\Admin\AppData\Roaming\Download\192957.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4128
          • C:\Users\Admin\AppData\Roaming\Download\192957.exe
            "C:\Users\Admin\AppData\Roaming\Download\192957.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5048
        • C:\Users\Admin\AppData\Roaming\Download\262014.exe
          "C:\Users\Admin\AppData\Roaming\Download\262014.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1608
          • C:\Users\Admin\AppData\Roaming\Download\262014.exe
            "C:\Users\Admin\AppData\Roaming\Download\262014.exe"
            5⤵
            • Executes dropped EXE
            PID:3328
        • C:\Users\Admin\AppData\Roaming\Download\766643.exe
          "C:\Users\Admin\AppData\Roaming\Download\766643.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:468
          • C:\Users\Admin\AppData\Roaming\Download\766643.exe
            "C:\Users\Admin\AppData\Roaming\Download\766643.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4720
        • C:\Users\Admin\AppData\Roaming\Download\925422.exe
          "C:\Users\Admin\AppData\Roaming\Download\925422.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5680
          • C:\Users\Admin\AppData\Roaming\Download\925422.exe
            "C:\Users\Admin\AppData\Roaming\Download\925422.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:820
        • C:\Users\Admin\AppData\Roaming\Download\274229.exe
          "C:\Users\Admin\AppData\Roaming\Download\274229.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5124
          • C:\Users\Admin\AppData\Roaming\Download\274229.exe
            "C:\Users\Admin\AppData\Roaming\Download\274229.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2588
        • C:\Users\Admin\AppData\Roaming\Download\978850.exe
          "C:\Users\Admin\AppData\Roaming\Download\978850.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4388
          • C:\Users\Admin\AppData\Roaming\Download\978850.exe
            "C:\Users\Admin\AppData\Roaming\Download\978850.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4720
        • C:\Users\Admin\AppData\Roaming\Download\869522.exe
          "C:\Users\Admin\AppData\Roaming\Download\869522.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6124
          • C:\Users\Admin\AppData\Roaming\Download\869522.exe
            "C:\Users\Admin\AppData\Roaming\Download\869522.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4700
        • C:\Users\Admin\AppData\Roaming\Download\118421.exe
          "C:\Users\Admin\AppData\Roaming\Download\118421.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3432
          • C:\Users\Admin\AppData\Roaming\Download\118421.exe
            "C:\Users\Admin\AppData\Roaming\Download\118421.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1636
        • C:\Users\Admin\AppData\Roaming\Download\065682.exe
          "C:\Users\Admin\AppData\Roaming\Download\065682.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3772
          • C:\Users\Admin\AppData\Roaming\Download\065682.exe
            "C:\Users\Admin\AppData\Roaming\Download\065682.exe"
            5⤵
            • Executes dropped EXE
            PID:4604
        • C:\Users\Admin\AppData\Roaming\Download\935549.exe
          "C:\Users\Admin\AppData\Roaming\Download\935549.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2820
          • C:\Users\Admin\AppData\Roaming\Download\935549.exe
            "C:\Users\Admin\AppData\Roaming\Download\935549.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6052
        • C:\Users\Admin\AppData\Roaming\Download\898323.exe
          "C:\Users\Admin\AppData\Roaming\Download\898323.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3412
          • C:\Users\Admin\AppData\Roaming\Download\898323.exe
            "C:\Users\Admin\AppData\Roaming\Download\898323.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4172
        • C:\Users\Admin\AppData\Roaming\Download\104790.exe
          "C:\Users\Admin\AppData\Roaming\Download\104790.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:900
          • C:\Users\Admin\AppData\Roaming\Download\104790.exe
            "C:\Users\Admin\AppData\Roaming\Download\104790.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3848
        • C:\Users\Admin\AppData\Roaming\Download\095482.exe
          "C:\Users\Admin\AppData\Roaming\Download\095482.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1888
          • C:\Users\Admin\AppData\Roaming\Download\095482.exe
            "C:\Users\Admin\AppData\Roaming\Download\095482.exe"
            5⤵
            • Executes dropped EXE
            PID:6048
        • C:\Users\Admin\AppData\Roaming\Download\540539.exe
          "C:\Users\Admin\AppData\Roaming\Download\540539.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5756
          • C:\Users\Admin\AppData\Roaming\Download\540539.exe
            "C:\Users\Admin\AppData\Roaming\Download\540539.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3516
        • C:\Users\Admin\AppData\Roaming\Download\172766.exe
          "C:\Users\Admin\AppData\Roaming\Download\172766.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4948
          • C:\Users\Admin\AppData\Roaming\Download\172766.exe
            "C:\Users\Admin\AppData\Roaming\Download\172766.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5428
        • C:\Users\Admin\AppData\Roaming\Download\228748.exe
          "C:\Users\Admin\AppData\Roaming\Download\228748.exe" /Shorttailedrestart
          4⤵
            PID:1984
            • C:\Users\Admin\AppData\Roaming\Download\228748.exe
              "C:\Users\Admin\AppData\Roaming\Download\228748.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3368
          • C:\Users\Admin\AppData\Roaming\Download\454821.exe
            "C:\Users\Admin\AppData\Roaming\Download\454821.exe" /Shorttailedrestart
            4⤵
              PID:4236
              • C:\Users\Admin\AppData\Roaming\Download\454821.exe
                "C:\Users\Admin\AppData\Roaming\Download\454821.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3416
            • C:\Users\Admin\AppData\Roaming\Download\045535.exe
              "C:\Users\Admin\AppData\Roaming\Download\045535.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5776
              • C:\Users\Admin\AppData\Roaming\Download\045535.exe
                "C:\Users\Admin\AppData\Roaming\Download\045535.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5692
            • C:\Users\Admin\AppData\Roaming\Download\548064.exe
              "C:\Users\Admin\AppData\Roaming\Download\548064.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:248
              • C:\Users\Admin\AppData\Roaming\Download\548064.exe
                "C:\Users\Admin\AppData\Roaming\Download\548064.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4124
            • C:\Users\Admin\AppData\Roaming\Download\847778.exe
              "C:\Users\Admin\AppData\Roaming\Download\847778.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3352
              • C:\Users\Admin\AppData\Roaming\Download\847778.exe
                "C:\Users\Admin\AppData\Roaming\Download\847778.exe"
                5⤵
                  PID:1892
              • C:\Users\Admin\AppData\Roaming\Download\341089.exe
                "C:\Users\Admin\AppData\Roaming\Download\341089.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3804
                • C:\Users\Admin\AppData\Roaming\Download\341089.exe
                  "C:\Users\Admin\AppData\Roaming\Download\341089.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2760
              • C:\Users\Admin\AppData\Roaming\Download\931901.exe
                "C:\Users\Admin\AppData\Roaming\Download\931901.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4104
                • C:\Users\Admin\AppData\Roaming\Download\931901.exe
                  "C:\Users\Admin\AppData\Roaming\Download\931901.exe"
                  5⤵
                    PID:2308
                • C:\Users\Admin\AppData\Roaming\Download\926169.exe
                  "C:\Users\Admin\AppData\Roaming\Download\926169.exe" /Shorttailedrestart
                  4⤵
                    PID:5476
                    • C:\Users\Admin\AppData\Roaming\Download\926169.exe
                      "C:\Users\Admin\AppData\Roaming\Download\926169.exe"
                      5⤵
                        PID:5700
                    • C:\Users\Admin\AppData\Roaming\Download\449678.exe
                      "C:\Users\Admin\AppData\Roaming\Download\449678.exe" /Shorttailedrestart
                      4⤵
                        PID:3636
                        • C:\Users\Admin\AppData\Roaming\Download\449678.exe
                          "C:\Users\Admin\AppData\Roaming\Download\449678.exe"
                          5⤵
                            PID:1460
                        • C:\Users\Admin\AppData\Roaming\Download\283024.exe
                          "C:\Users\Admin\AppData\Roaming\Download\283024.exe" /Shorttailedrestart
                          4⤵
                            PID:1380
                            • C:\Users\Admin\AppData\Roaming\Download\283024.exe
                              "C:\Users\Admin\AppData\Roaming\Download\283024.exe"
                              5⤵
                                PID:4124
                            • C:\Users\Admin\AppData\Roaming\Download\512823.exe
                              "C:\Users\Admin\AppData\Roaming\Download\512823.exe" /Shorttailedrestart
                              4⤵
                                PID:1116
                                • C:\Users\Admin\AppData\Roaming\Download\512823.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\512823.exe"
                                  5⤵
                                    PID:4316
                                • C:\Users\Admin\AppData\Roaming\Download\667805.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\667805.exe" /Shorttailedrestart
                                  4⤵
                                    PID:3524
                                    • C:\Users\Admin\AppData\Roaming\Download\667805.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\667805.exe"
                                      5⤵
                                        PID:3876
                                    • C:\Users\Admin\AppData\Roaming\Download\258418.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\258418.exe" /Shorttailedrestart
                                      4⤵
                                        PID:3848
                                        • C:\Users\Admin\AppData\Roaming\Download\258418.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\258418.exe"
                                          5⤵
                                            PID:1300
                                        • C:\Users\Admin\AppData\Roaming\Download\658122.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\658122.exe" /Shorttailedrestart
                                          4⤵
                                            PID:1348
                                            • C:\Users\Admin\AppData\Roaming\Download\658122.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\658122.exe"
                                              5⤵
                                                PID:3368
                                            • C:\Users\Admin\AppData\Roaming\Download\947836.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\947836.exe" /Shorttailedrestart
                                              4⤵
                                                PID:5648
                                                • C:\Users\Admin\AppData\Roaming\Download\947836.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\947836.exe"
                                                  5⤵
                                                    PID:1460
                                                • C:\Users\Admin\AppData\Roaming\Download\233184.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\233184.exe" /Shorttailedrestart
                                                  4⤵
                                                    PID:4896
                                                    • C:\Users\Admin\AppData\Roaming\Download\233184.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\233184.exe"
                                                      5⤵
                                                        PID:4712
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                                  2⤵
                                                  • Drops file in Windows directory
                                                  • Enumerates system info in registry
                                                  • Modifies registry class
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1260
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe11aac188,0x7ffe11aac194,0x7ffe11aac1a0
                                                    3⤵
                                                      PID:2016
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,16339929781177873769,13711148475515991308,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
                                                      3⤵
                                                      • System Time Discovery
                                                      PID:4472
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,18350485118764781440,1170015354937040352,262144 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
                                                      3⤵
                                                        PID:4968
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,16956585123746360818,13536739755304447681,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
                                                        3⤵
                                                          PID:6032
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,12971763675122229496,11909051077274636137,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                                                          3⤵
                                                            PID:5888
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,11772092408110846323,18077346328503010854,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
                                                            3⤵
                                                              PID:4732
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,14505264841799523640,11997093542711805847,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
                                                              3⤵
                                                                PID:6140
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8727360506536556791,3004769988750266353,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
                                                                3⤵
                                                                  PID:5032
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,15611948664832562009,11373939352631602840,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
                                                                  3⤵
                                                                    PID:3152
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,416084391484621281,5281473970787093950,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
                                                                    3⤵
                                                                      PID:2796
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,4848837547549484323,14373180187861742702,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                                                                      3⤵
                                                                        PID:468
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,18341819210304254165,3057072081116388767,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                                                        3⤵
                                                                          PID:1460
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,18341819210304254165,3057072081116388767,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                                                          3⤵
                                                                            PID:3764
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16487163134317768814,16699421371571824512,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
                                                                            3⤵
                                                                              PID:4116
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5376,i,1717609664712537123,5779822570136354562,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
                                                                              3⤵
                                                                                PID:6120
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2968783185922306423,2134540189509602315,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                                                                                3⤵
                                                                                  PID:1288
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,14243624967848557584,9044902188225797566,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
                                                                                  3⤵
                                                                                  • Modifies registry class
                                                                                  PID:5992
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,10734129982656480368,1977153936059760074,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:12
                                                                                  3⤵
                                                                                    PID:3780
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3712,i,14310838865348554996,17341550957224954329,2097152 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
                                                                                    3⤵
                                                                                      PID:6076
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15312532658610161078,17744855336267231243,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
                                                                                      3⤵
                                                                                        PID:3656
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9530637191322663811,9469391470768112368,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
                                                                                        3⤵
                                                                                          PID:5576
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,5415833931510187161,3241021289010591190,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                                                                          3⤵
                                                                                            PID:556
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15202704247658080759,2059830811860548123,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:14
                                                                                            3⤵
                                                                                              PID:4940
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,17555468999515000630,9680097953222403397,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
                                                                                              3⤵
                                                                                                PID:4448
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8689401391507790906,8298596781981757665,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:3392
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11585057840185872185,645776212110523678,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:1636
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,16682764595070616071,1172506655060420764,262144 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
                                                                                                    3⤵
                                                                                                      PID:2900
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,6743585797968265291,9046313003451733164,524288 --field-trial-handle=2488,i,5360864471231446560,10352160938237331943,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
                                                                                                      3⤵
                                                                                                        PID:5432
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                      2⤵
                                                                                                        PID:4468
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                      1⤵
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2512
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                        2⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        PID:5764
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:1988
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                        1⤵
                                                                                                          PID:1056

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              DouTuDaShi.exe
                                                                                                              • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                              • Size 1.1MB
                                                                                                              • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              1ebd4fa9-13dd-4856-ac17-9f3be363f163.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ebd4fa9-13dd-4856-ac17-9f3be363f163.tmp
                                                                                                              • Size 37KB
                                                                                                              • SHA256 222c3230873fcbacbf15c26fd0c9d1bb575f63d85ef864ffa6fbf2f856fcf501
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              9870545d-af69-4cdd-8736-5e20e7b5528e.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9870545d-af69-4cdd-8736-5e20e7b5528e.tmp
                                                                                                              • Size 33KB
                                                                                                              • SHA256 61413d7d2df9ec32d33c912d73eed417c22bf517b876537ebe679e4aa2eeeef4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              settings.dat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              • Size 280B
                                                                                                              • SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              settings.dat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              • Size 280B
                                                                                                              • SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              1cd72d88-5815-4e6c-bed5-8b9866b3e22b.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cd72d88-5815-4e6c-bed5-8b9866b3e22b.tmp
                                                                                                              • Size 12KB
                                                                                                              • SHA256 280a7aefc7d14bc74fe312f50bdf489159f6d361976a90a041e89fb4d5f223a5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              203f26e7-7619-4256-b57d-31ccacd59ac4.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\203f26e7-7619-4256-b57d-31ccacd59ac4.tmp
                                                                                                              • Size 70KB
                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              40592ab5-b347-41c9-b981-101547d8a62d.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40592ab5-b347-41c9-b981-101547d8a62d.tmp
                                                                                                              • Size 29KB
                                                                                                              • SHA256 b72ee4d935518d95adc0a1ccf99bd1f7fbfcb438e1721cd58e68de681b902b22
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              66d00c1b-7559-4be1-bd51-058cfaa1cdd6.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66d00c1b-7559-4be1-bd51-058cfaa1cdd6.tmp
                                                                                                              • Size 12KB
                                                                                                              • SHA256 feeb38785c55644d38eed9657af242b8de10903d7d3a8b8716a058f707c19f4e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                              • Size 6B
                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              f_000063
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                                                              • Size 61KB
                                                                                                              • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              96f9b4f9adf74a24_0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                              • Size 213B
                                                                                                              • SHA256 8c8831173b12c7430c7e774f01faa1912859257aea447b6302a74e3e3da2bd33
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              a778f3c2e962d2a7_0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a778f3c2e962d2a7_0
                                                                                                              • Size 223B
                                                                                                              • SHA256 fb40fe405d82394b2b6738d7a1bbb72c7d677ebf7b9d0aa89c94f0048b302f40
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              temp-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                              • Size 4KB
                                                                                                              • SHA256 972c0b7a48fa73ec00efc80f579348ff1a4bc2a6146a124391107e1face2a47c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 3KB
                                                                                                              • SHA256 707861af3334a0205caf807d3e0a72f0a1b15c62196991fbee4d580e74e9deb3
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              ec0f0057-7215-49c7-a0a6-ed2ba70839f7.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ec0f0057-7215-49c7-a0a6-ed2ba70839f7.tmp
                                                                                                              • Size 2B
                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              242ebf95-6762-40b9-b6c5-b961fd8a4e93.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\242ebf95-6762-40b9-b6c5-b961fd8a4e93.tmp
                                                                                                              • Size 2B
                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              949fcab9-fd14-4ff3-94ea-b62de7df019c.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\949fcab9-fd14-4ff3-94ea-b62de7df019c.tmp
                                                                                                              • Size 40B
                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              9793d9ad-95be-4c15-ac10-6e92bc0d1752.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9793d9ad-95be-4c15-ac10-6e92bc0d1752.tmp
                                                                                                              • Size 6KB
                                                                                                              • SHA256 640d491d48a06218b30eb6f6b0d64db6cd84dd5b8451b8230a959f8b83105c95
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              sync_diagnostic.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                              • Size 4KB
                                                                                                              • SHA256 b1885ad600d570154aa73c2bb3726764be785f3199dda1f6b207f002ed2164ff
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              c5e87acc-cd70-49e7-8033-c95a7e7afcd1.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5e87acc-cd70-49e7-8033-c95a7e7afcd1.tmp
                                                                                                              • Size 12KB
                                                                                                              • SHA256 6bd2088342cbedd160234ec8d9bce17bd7eac4946a9478dfa2322fb128e8ae8f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              1af03fe9-d30a-438d-8766-d6179cf8a344.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1af03fe9-d30a-438d-8766-d6179cf8a344.tmp
                                                                                                              • Size 22KB
                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              OperationConfig
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                              • Size 3KB
                                                                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              a57f25eb-56f3-4dde-9547-1c4fc25a0707.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a57f25eb-56f3-4dde-9547-1c4fc25a0707.tmp
                                                                                                              • Size 33KB
                                                                                                              • SHA256 a0ff2f312d857a90c1cbbaca3acf7473af85742103cfb082512730671602eb98
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              3cb84348-929f-44af-9449-f4e3a4f3e4f7.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3cb84348-929f-44af-9449-f4e3a4f3e4f7.tmp
                                                                                                              • Size 252B
                                                                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              54a2b6df-eb55-4a25-886b-d8ababc7270a.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\54a2b6df-eb55-4a25-886b-d8ababc7270a.tmp
                                                                                                              • Size 372B
                                                                                                              • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              ea4e1c9a-cf8d-4a01-be8d-eae5bd21f21b.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ea4e1c9a-cf8d-4a01-be8d-eae5bd21f21b.tmp
                                                                                                              • Size 132B
                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              d3e081c5-3a22-4652-8445-8d65d6b74567.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3e081c5-3a22-4652-8445-8d65d6b74567.tmp
                                                                                                              • Size 42KB
                                                                                                              • SHA256 2a0ac3e60d856b5a626de0fed652be139e21fdfef884c977cd8d6ed5459b8865
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              5da56c77-0153-462b-b008-432b2e24e8bf.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5da56c77-0153-462b-b008-432b2e24e8bf.tmp
                                                                                                              • Size 13B
                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              hao.360[1].xml
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VKYQ5M8J\hao.360[1].xml
                                                                                                              • Size 2KB
                                                                                                              • SHA256 3a4751402ce11d3d38c06ab1b63c3df905009e4cb65823884a112334a1b206a1
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              hao.360[1].xml
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VKYQ5M8J\hao.360[1].xml
                                                                                                              • Size 7KB
                                                                                                              • SHA256 75eb0f0db4c0b9952214b043ce5069d5450ef5ba83983743e218bf2078f636b4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              sed_api_weather_info[1].htm
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S4MXVBLB\sed_api_weather_info[1].htm
                                                                                                              • Size 7KB
                                                                                                              • SHA256 c8c1aa9eb68c22ce6ffa5adc672771141cb3ee12024bf7a6d16a8bb135649645
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              1[1].png
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U8AUWZTD\1[1].png
                                                                                                              • Size 619B
                                                                                                              • SHA256 1a86129daf6f178ca62d8558865794f0aa86d6898b021cebcc1b554722b22e3b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              time[1].js
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XDW2KZVM\time[1].js
                                                                                                              • Size 27B
                                                                                                              • SHA256 c4cf6e79bea0549204853fd005cf9c1eed220753f6d876ee71fcf53d7690ecd5
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              0b0e5130-21d2-42da-ae8e-971d7d160fd2.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\0b0e5130-21d2-42da-ae8e-971d7d160fd2.tmp
                                                                                                              • Size 1B
                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              96d0537a-6326-4fd2-a7d9-eea37520f3a1.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\96d0537a-6326-4fd2-a7d9-eea37520f3a1.tmp
                                                                                                              • Size 10KB
                                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              jatgfr.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\jatgfr.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 3592d142cc5e50ac55bb36f9bb3e1cd27c436dfc4e8c0b1a223721bd99733b2f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              ldsajdklsajdlkjsalkda.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                              • Size 589B
                                                                                                              • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              content.js
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1260_714037625\CRX_INSTALL\content.js
                                                                                                              • Size 9KB
                                                                                                              • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              012213.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\012213.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 4f75dfd26f24ace06a4386c0e82a7f5e8e27373718d8b0bd239f98bce6a488f1
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              039539.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\039539.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 36ce7da852f3b47d23605ae1c1c7ea22286b1caa3903c070878f1e3dd520758d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              109132.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\109132.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 9858875d65219975c3ea778163dbf159f631634eb108a01835886e743536fcfb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              191824.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\191824.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 a6833a7ac7cb992fef9a861931f44832565df405e8a95a156352745990b7e91f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              205396.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\205396.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 9adeb83d7e37cd6e6f15a841a77e162759add64faf5999e37580aac86fbff9b5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              425194.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\425194.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 3faf6b942379ea05794e96ef1ec6b4639de07f36f164195da7ee5fe0c6a5f09d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              467144.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\467144.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 8ea5d4b1e106a8f23bb1fe98966172a397001e3dd8f602f48707a57f4c9865b8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              514841.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\514841.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 16a1f0d0299f7f985bc666adb5faf9c5a52c8779cef611211b3d978847db27ec
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              629849.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\629849.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 0099f9d47b35993ccaaf7b0cf1886189e3ecb583f6116cd93b17d79a9907330f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              735340.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\735340.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 f61b7e4c9ed347c904f331cb1ee355714bbf3c9f01d079ade048d8e24d78daa6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              799727.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\799727.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 338bc2f7f7b34451fd9c26cc0b630f4c82796044121649ff87e4ebe22557f258
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              920537.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\920537.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 322293cd39d22ec28423be3bdfda1032d2877e10b9fba3113853893a7eb4b0be
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              929604.exe
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Download\929604.exe
                                                                                                              • Size 1.5MB
                                                                                                              • SHA256 f755616d2837a8fd973e23751def5574756e7d4df3a9e4103007e86541b2cf8a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              manifest.json
                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1398167906\manifest.json
                                                                                                              • Size 43B
                                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              manifest.json
                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1464600757\manifest.json
                                                                                                              • Size 135B
                                                                                                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              manifest.json
                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_319347741\manifest.json
                                                                                                              • Size 165B
                                                                                                              • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              manifest.json
                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_46149639\manifest.json
                                                                                                              • Size 160B
                                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              memory/2992-183-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1160-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1111-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1205-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1059-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1242-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-436-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-1288-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3740-688-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                              Download