Overview

overview

7

Static

static

3

2026-10-06...op.exe

windows10-2004-x64

7

2026-10-06...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-06_711ac97d6e041a2c137813229bc25479_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261006-pmesvsbs5k
  • SHA256 74161eb435088ced555f0b4673c73019ebd5cb4d9dcbd8b335ff758be3815f7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_711ac97d6e041a2c137813229bc25479_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-06_711ac97d6e041a2c137813229bc25479_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2288
    • C:\Users\Admin\AppData\Local\Temp\okgmhz.exe
      "C:\Users\Admin\AppData\Local\Temp\okgmhz.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Users\Admin\AppData\Local\Temp\okgmhz.exe
        "C:\Users\Admin\AppData\Local\Temp\okgmhz.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Users\Admin\AppData\Roaming\Download\812738.exe
          "C:\Users\Admin\AppData\Roaming\Download\812738.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Users\Admin\AppData\Roaming\Download\812738.exe
            "C:\Users\Admin\AppData\Roaming\Download\812738.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4892
        • C:\Users\Admin\AppData\Roaming\Download\328210.exe
          "C:\Users\Admin\AppData\Roaming\Download\328210.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1808
          • C:\Users\Admin\AppData\Roaming\Download\328210.exe
            "C:\Users\Admin\AppData\Roaming\Download\328210.exe"
            5⤵
            • Executes dropped EXE
            PID:1652
        • C:\Users\Admin\AppData\Roaming\Download\600402.exe
          "C:\Users\Admin\AppData\Roaming\Download\600402.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4600
          • C:\Users\Admin\AppData\Roaming\Download\600402.exe
            "C:\Users\Admin\AppData\Roaming\Download\600402.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1384
        • C:\Users\Admin\AppData\Roaming\Download\315957.exe
          "C:\Users\Admin\AppData\Roaming\Download\315957.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Users\Admin\AppData\Roaming\Download\315957.exe
            "C:\Users\Admin\AppData\Roaming\Download\315957.exe"
            5⤵
            • Executes dropped EXE
            PID:1384
        • C:\Users\Admin\AppData\Roaming\Download\054998.exe
          "C:\Users\Admin\AppData\Roaming\Download\054998.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6016
          • C:\Users\Admin\AppData\Roaming\Download\054998.exe
            "C:\Users\Admin\AppData\Roaming\Download\054998.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2268
        • C:\Users\Admin\AppData\Roaming\Download\616612.exe
          "C:\Users\Admin\AppData\Roaming\Download\616612.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Users\Admin\AppData\Roaming\Download\616612.exe
            "C:\Users\Admin\AppData\Roaming\Download\616612.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4448
        • C:\Users\Admin\AppData\Roaming\Download\118223.exe
          "C:\Users\Admin\AppData\Roaming\Download\118223.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Users\Admin\AppData\Roaming\Download\118223.exe
            "C:\Users\Admin\AppData\Roaming\Download\118223.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1476
        • C:\Users\Admin\AppData\Roaming\Download\673569.exe
          "C:\Users\Admin\AppData\Roaming\Download\673569.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4276
          • C:\Users\Admin\AppData\Roaming\Download\673569.exe
            "C:\Users\Admin\AppData\Roaming\Download\673569.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3456
        • C:\Users\Admin\AppData\Roaming\Download\912466.exe
          "C:\Users\Admin\AppData\Roaming\Download\912466.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6084
          • C:\Users\Admin\AppData\Roaming\Download\912466.exe
            "C:\Users\Admin\AppData\Roaming\Download\912466.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2392
        • C:\Users\Admin\AppData\Roaming\Download\501070.exe
          "C:\Users\Admin\AppData\Roaming\Download\501070.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:696
          • C:\Users\Admin\AppData\Roaming\Download\501070.exe
            "C:\Users\Admin\AppData\Roaming\Download\501070.exe"
            5⤵
            • Executes dropped EXE
            PID:1952
        • C:\Users\Admin\AppData\Roaming\Download\860979.exe
          "C:\Users\Admin\AppData\Roaming\Download\860979.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5256
          • C:\Users\Admin\AppData\Roaming\Download\860979.exe
            "C:\Users\Admin\AppData\Roaming\Download\860979.exe"
            5⤵
            • Executes dropped EXE
            PID:4840
        • C:\Users\Admin\AppData\Roaming\Download\905830.exe
          "C:\Users\Admin\AppData\Roaming\Download\905830.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1944
          • C:\Users\Admin\AppData\Roaming\Download\905830.exe
            "C:\Users\Admin\AppData\Roaming\Download\905830.exe"
            5⤵
            • Executes dropped EXE
            PID:5324
        • C:\Users\Admin\AppData\Roaming\Download\957019.exe
          "C:\Users\Admin\AppData\Roaming\Download\957019.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5800
          • C:\Users\Admin\AppData\Roaming\Download\957019.exe
            "C:\Users\Admin\AppData\Roaming\Download\957019.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5608
        • C:\Users\Admin\AppData\Roaming\Download\072618.exe
          "C:\Users\Admin\AppData\Roaming\Download\072618.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2604
          • C:\Users\Admin\AppData\Roaming\Download\072618.exe
            "C:\Users\Admin\AppData\Roaming\Download\072618.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3584
        • C:\Users\Admin\AppData\Roaming\Download\641520.exe
          "C:\Users\Admin\AppData\Roaming\Download\641520.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3276
          • C:\Users\Admin\AppData\Roaming\Download\641520.exe
            "C:\Users\Admin\AppData\Roaming\Download\641520.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2412
        • C:\Users\Admin\AppData\Roaming\Download\969055.exe
          "C:\Users\Admin\AppData\Roaming\Download\969055.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5608
          • C:\Users\Admin\AppData\Roaming\Download\969055.exe
            "C:\Users\Admin\AppData\Roaming\Download\969055.exe"
            5⤵
            • Executes dropped EXE
            PID:4536
        • C:\Users\Admin\AppData\Roaming\Download\321749.exe
          "C:\Users\Admin\AppData\Roaming\Download\321749.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5388
          • C:\Users\Admin\AppData\Roaming\Download\321749.exe
            "C:\Users\Admin\AppData\Roaming\Download\321749.exe"
            5⤵
            • Executes dropped EXE
            PID:2756
        • C:\Users\Admin\AppData\Roaming\Download\792463.exe
          "C:\Users\Admin\AppData\Roaming\Download\792463.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3468
          • C:\Users\Admin\AppData\Roaming\Download\792463.exe
            "C:\Users\Admin\AppData\Roaming\Download\792463.exe"
            5⤵
            • Executes dropped EXE
            PID:3860
        • C:\Users\Admin\AppData\Roaming\Download\493992.exe
          "C:\Users\Admin\AppData\Roaming\Download\493992.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2452
          • C:\Users\Admin\AppData\Roaming\Download\493992.exe
            "C:\Users\Admin\AppData\Roaming\Download\493992.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1880
        • C:\Users\Admin\AppData\Roaming\Download\162035.exe
          "C:\Users\Admin\AppData\Roaming\Download\162035.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:896
          • C:\Users\Admin\AppData\Roaming\Download\162035.exe
            "C:\Users\Admin\AppData\Roaming\Download\162035.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1464
        • C:\Users\Admin\AppData\Roaming\Download\664564.exe
          "C:\Users\Admin\AppData\Roaming\Download\664564.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1868
          • C:\Users\Admin\AppData\Roaming\Download\664564.exe
            "C:\Users\Admin\AppData\Roaming\Download\664564.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4448
        • C:\Users\Admin\AppData\Roaming\Download\113463.exe
          "C:\Users\Admin\AppData\Roaming\Download\113463.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4404
          • C:\Users\Admin\AppData\Roaming\Download\113463.exe
            "C:\Users\Admin\AppData\Roaming\Download\113463.exe"
            5⤵
            • Executes dropped EXE
            PID:3436
        • C:\Users\Admin\AppData\Roaming\Download\758707.exe
          "C:\Users\Admin\AppData\Roaming\Download\758707.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4280
          • C:\Users\Admin\AppData\Roaming\Download\758707.exe
            "C:\Users\Admin\AppData\Roaming\Download\758707.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1104
        • C:\Users\Admin\AppData\Roaming\Download\111402.exe
          "C:\Users\Admin\AppData\Roaming\Download\111402.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5340
          • C:\Users\Admin\AppData\Roaming\Download\111402.exe
            "C:\Users\Admin\AppData\Roaming\Download\111402.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5220
        • C:\Users\Admin\AppData\Roaming\Download\926958.exe
          "C:\Users\Admin\AppData\Roaming\Download\926958.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2224
          • C:\Users\Admin\AppData\Roaming\Download\926958.exe
            "C:\Users\Admin\AppData\Roaming\Download\926958.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5144
        • C:\Users\Admin\AppData\Roaming\Download\420467.exe
          "C:\Users\Admin\AppData\Roaming\Download\420467.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5260
          • C:\Users\Admin\AppData\Roaming\Download\420467.exe
            "C:\Users\Admin\AppData\Roaming\Download\420467.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:244
        • C:\Users\Admin\AppData\Roaming\Download\053603.exe
          "C:\Users\Admin\AppData\Roaming\Download\053603.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:476
          • C:\Users\Admin\AppData\Roaming\Download\053603.exe
            "C:\Users\Admin\AppData\Roaming\Download\053603.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1464
        • C:\Users\Admin\AppData\Roaming\Download\175667.exe
          "C:\Users\Admin\AppData\Roaming\Download\175667.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:984
          • C:\Users\Admin\AppData\Roaming\Download\175667.exe
            "C:\Users\Admin\AppData\Roaming\Download\175667.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:692
        • C:\Users\Admin\AppData\Roaming\Download\640277.exe
          "C:\Users\Admin\AppData\Roaming\Download\640277.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5480
          • C:\Users\Admin\AppData\Roaming\Download\640277.exe
            "C:\Users\Admin\AppData\Roaming\Download\640277.exe"
            5⤵
            • Executes dropped EXE
            PID:3224
        • C:\Users\Admin\AppData\Roaming\Download\144506.exe
          "C:\Users\Admin\AppData\Roaming\Download\144506.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:788
          • C:\Users\Admin\AppData\Roaming\Download\144506.exe
            "C:\Users\Admin\AppData\Roaming\Download\144506.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2836
        • C:\Users\Admin\AppData\Roaming\Download\788952.exe
          "C:\Users\Admin\AppData\Roaming\Download\788952.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1104
          • C:\Users\Admin\AppData\Roaming\Download\788952.exe
            "C:\Users\Admin\AppData\Roaming\Download\788952.exe"
            5⤵
              PID:692
          • C:\Users\Admin\AppData\Roaming\Download\237739.exe
            "C:\Users\Admin\AppData\Roaming\Download\237739.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5084
            • C:\Users\Admin\AppData\Roaming\Download\237739.exe
              "C:\Users\Admin\AppData\Roaming\Download\237739.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4392
          • C:\Users\Admin\AppData\Roaming\Download\527443.exe
            "C:\Users\Admin\AppData\Roaming\Download\527443.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4124
            • C:\Users\Admin\AppData\Roaming\Download\527443.exe
              "C:\Users\Admin\AppData\Roaming\Download\527443.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1760
          • C:\Users\Admin\AppData\Roaming\Download\374706.exe
            "C:\Users\Admin\AppData\Roaming\Download\374706.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1692
            • C:\Users\Admin\AppData\Roaming\Download\374706.exe
              "C:\Users\Admin\AppData\Roaming\Download\374706.exe"
              5⤵
                PID:4504
            • C:\Users\Admin\AppData\Roaming\Download\049226.exe
              "C:\Users\Admin\AppData\Roaming\Download\049226.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2556
              • C:\Users\Admin\AppData\Roaming\Download\049226.exe
                "C:\Users\Admin\AppData\Roaming\Download\049226.exe"
                5⤵
                  PID:3396
              • C:\Users\Admin\AppData\Roaming\Download\571746.exe
                "C:\Users\Admin\AppData\Roaming\Download\571746.exe" /Shorttailedrestart
                4⤵
                  PID:4688
                  • C:\Users\Admin\AppData\Roaming\Download\571746.exe
                    "C:\Users\Admin\AppData\Roaming\Download\571746.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1080
                • C:\Users\Admin\AppData\Roaming\Download\720643.exe
                  "C:\Users\Admin\AppData\Roaming\Download\720643.exe" /Shorttailedrestart
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2496
                  • C:\Users\Admin\AppData\Roaming\Download\720643.exe
                    "C:\Users\Admin\AppData\Roaming\Download\720643.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3268
                • C:\Users\Admin\AppData\Roaming\Download\536878.exe
                  "C:\Users\Admin\AppData\Roaming\Download\536878.exe" /Shorttailedrestart
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4448
                  • C:\Users\Admin\AppData\Roaming\Download\536878.exe
                    "C:\Users\Admin\AppData\Roaming\Download\536878.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3456
                • C:\Users\Admin\AppData\Roaming\Download\926783.exe
                  "C:\Users\Admin\AppData\Roaming\Download\926783.exe" /Shorttailedrestart
                  4⤵
                    PID:3516
                    • C:\Users\Admin\AppData\Roaming\Download\926783.exe
                      "C:\Users\Admin\AppData\Roaming\Download\926783.exe"
                      5⤵
                        PID:3400
                    • C:\Users\Admin\AppData\Roaming\Download\737388.exe
                      "C:\Users\Admin\AppData\Roaming\Download\737388.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1960
                      • C:\Users\Admin\AppData\Roaming\Download\737388.exe
                        "C:\Users\Admin\AppData\Roaming\Download\737388.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4856
                    • C:\Users\Admin\AppData\Roaming\Download\431696.exe
                      "C:\Users\Admin\AppData\Roaming\Download\431696.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6076
                      • C:\Users\Admin\AppData\Roaming\Download\431696.exe
                        "C:\Users\Admin\AppData\Roaming\Download\431696.exe"
                        5⤵
                          PID:1572
                      • C:\Users\Admin\AppData\Roaming\Download\780596.exe
                        "C:\Users\Admin\AppData\Roaming\Download\780596.exe" /Shorttailedrestart
                        4⤵
                          PID:5032
                          • C:\Users\Admin\AppData\Roaming\Download\780596.exe
                            "C:\Users\Admin\AppData\Roaming\Download\780596.exe"
                            5⤵
                              PID:248
                          • C:\Users\Admin\AppData\Roaming\Download\070300.exe
                            "C:\Users\Admin\AppData\Roaming\Download\070300.exe" /Shorttailedrestart
                            4⤵
                              PID:5748
                              • C:\Users\Admin\AppData\Roaming\Download\070300.exe
                                "C:\Users\Admin\AppData\Roaming\Download\070300.exe"
                                5⤵
                                  PID:3168
                              • C:\Users\Admin\AppData\Roaming\Download\927460.exe
                                "C:\Users\Admin\AppData\Roaming\Download\927460.exe" /Shorttailedrestart
                                4⤵
                                  PID:4184
                                  • C:\Users\Admin\AppData\Roaming\Download\927460.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\927460.exe"
                                    5⤵
                                      PID:4552
                                  • C:\Users\Admin\AppData\Roaming\Download\420971.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\420971.exe" /Shorttailedrestart
                                    4⤵
                                      PID:4372
                                      • C:\Users\Admin\AppData\Roaming\Download\420971.exe
                                        "C:\Users\Admin\AppData\Roaming\Download\420971.exe"
                                        5⤵
                                          PID:4260
                                      • C:\Users\Admin\AppData\Roaming\Download\819693.exe
                                        "C:\Users\Admin\AppData\Roaming\Download\819693.exe" /Shorttailedrestart
                                        4⤵
                                          PID:2560
                                          • C:\Users\Admin\AppData\Roaming\Download\819693.exe
                                            "C:\Users\Admin\AppData\Roaming\Download\819693.exe"
                                            5⤵
                                              PID:1760
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                        2⤵
                                        • Drops file in Windows directory
                                        • Enumerates system info in registry
                                        • Modifies registry class
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of WriteProcessMemory
                                        PID:996
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7fff6b94c188,0x7fff6b94c194,0x7fff6b94c1a0
                                          3⤵
                                            PID:5268
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,610269164534972081,12305933796427964410,262144 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
                                            3⤵
                                              PID:4252
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,10589064589260256953,10430800555848850752,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
                                              3⤵
                                              • System Time Discovery
                                              PID:5780
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5865247833257976140,1577607281436485529,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
                                              3⤵
                                                PID:4108
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14707413218128279993,16096097861570451024,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                                                3⤵
                                                  PID:6140
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,8432960053718088458,4339236341435997757,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
                                                  3⤵
                                                    PID:6088
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8917561175059549579,468033741680867423,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:9
                                                    3⤵
                                                      PID:2284
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,6804073695888426225,17354157870744221714,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
                                                      3⤵
                                                        PID:1528
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,17408234217208218239,12724408738815710727,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
                                                        3⤵
                                                          PID:4440
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5456,i,7790772583168948782,5873051310314481496,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
                                                          3⤵
                                                            PID:4780
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8530337614020523784,10541429846707142511,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
                                                            3⤵
                                                              PID:5700
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,18182400610644960458,12494572199629156666,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
                                                              3⤵
                                                                PID:5560
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9485637915780950408,1101740378671525880,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                                3⤵
                                                                  PID:3416
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9485637915780950408,1101740378671525880,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                                  3⤵
                                                                    PID:5440
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,272227417284793434,3496032888553086896,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
                                                                    3⤵
                                                                      PID:5580
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,1774498401267736936,9345134294634472211,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
                                                                      3⤵
                                                                        PID:5336
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,10992532112498063408,10512276964661933101,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
                                                                        3⤵
                                                                          PID:3348
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9629902343500352258,3172034871403156993,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
                                                                          3⤵
                                                                            PID:1980
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,5402335538394112365,18410889051308511581,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
                                                                            3⤵
                                                                              PID:5324
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,15125426228036256440,6026048942569542094,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
                                                                              3⤵
                                                                              • Modifies registry class
                                                                              PID:4444
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,15318900984466081346,12150997207828260705,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:12
                                                                              3⤵
                                                                                PID:3120
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5652,i,14838365258384371928,14932712670733440455,2097152 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:1
                                                                                3⤵
                                                                                  PID:5196
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,16151309396479924491,12249091615997506276,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
                                                                                  3⤵
                                                                                    PID:2268
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5545080260221638765,8240717052921700876,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                                                                    3⤵
                                                                                      PID:4312
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10466908863270744103,14832502464403012097,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
                                                                                      3⤵
                                                                                        PID:2076
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14562350003521272462,17459229055412649490,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
                                                                                        3⤵
                                                                                          PID:2168
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,210855836288763938,9040193861744706375,262144 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:10
                                                                                          3⤵
                                                                                            PID:672
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17071950343181686526,18000152901083391724,524288 --field-trial-handle=2296,i,13445309290424067621,1554329692445107461,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:14
                                                                                            3⤵
                                                                                              PID:3428
                                                                                          • C:\Windows\explorer.exe
                                                                                            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                            2⤵
                                                                                              PID:4328
                                                                                          • C:\Windows\explorer.exe
                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1244
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:1320
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:5692
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:1592

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    DouTuDaShi.exe
                                                                                                    • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                    • Size 1.1MB
                                                                                                    • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    24daeec0-d0ab-4be7-a51e-0e013f4e4810.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24daeec0-d0ab-4be7-a51e-0e013f4e4810.tmp
                                                                                                    • Size 37KB
                                                                                                    • SHA256 e138d45d944d4388b23d3d3a979ce411b6b935ee1474ba6ff2065440967718dc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    34373660-ba90-46c4-a0f8-49122ab13257.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34373660-ba90-46c4-a0f8-49122ab13257.tmp
                                                                                                    • Size 42KB
                                                                                                    • SHA256 66372de72310e6580d0b2b36a198a3b85e557670beab32667414fa06e2add94e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    35fa7c71-9b64-4a16-8a0f-a6e920582507.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35fa7c71-9b64-4a16-8a0f-a6e920582507.tmp
                                                                                                    • Size 34KB
                                                                                                    • SHA256 6414673c03b363c778f6249996120b5e37fa22f8813385c32d413e28f03741a4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    5ae41274-7970-443e-a437-cfba7e051305.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ae41274-7970-443e-a437-cfba7e051305.tmp
                                                                                                    • Size 39KB
                                                                                                    • SHA256 cd6c4cce51fb0b01fff1591955e4cc94d376d75798eb1063e2d7fecc54a4ebec
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    5cd999d5-3958-48fb-b9ef-8b9e7d6b85fc.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cd999d5-3958-48fb-b9ef-8b9e7d6b85fc.tmp
                                                                                                    • Size 29KB
                                                                                                    • SHA256 8310d2bc419cb19314379faed956efd6fbee5f157d30b5a190f6cfb47153a733
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    7571802e-7003-4fcc-9bb7-72541183b535.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7571802e-7003-4fcc-9bb7-72541183b535.tmp
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    96f9b4f9adf74a24_0
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                    • Size 213B
                                                                                                    • SHA256 8e421b09869ae2e06bdf819eb9b7ebe87a9affd8309c811be63aa1e88204a0b8
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    temp-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                    • Size 4KB
                                                                                                    • SHA256 c709917d48b21cee1a049fba99a916ff1ee30a8694ff10bd87f286d7bff6a4a2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 3KB
                                                                                                    • SHA256 f8b128be505d9afc76f76906b07195a9542b5cb9f80b51ad1c9a7a9bfd400298
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    6278b18a-e4f7-45f9-9cc5-c35833679e69.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6278b18a-e4f7-45f9-9cc5-c35833679e69.tmp
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    02eeb51c-e213-4d92-8f1f-b4c02da35140.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02eeb51c-e213-4d92-8f1f-b4c02da35140.tmp
                                                                                                    • Size 6KB
                                                                                                    • SHA256 1782bd323ce53e77691066bb5b14abbbd81e8f9ea2f90d38d2d3c057c23291a7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    6c803d7c-5419-4a90-af6f-1ce2663e2a02.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c803d7c-5419-4a90-af6f-1ce2663e2a02.tmp
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    ccdc85ba-f08f-42f9-9645-2f95920fbf08.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ccdc85ba-f08f-42f9-9645-2f95920fbf08.tmp
                                                                                                    • Size 40B
                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 11KB
                                                                                                    • SHA256 9f9335cbc059542e8b505f64667a52312618e6b64c4554df32bcaea705dc2a6f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    b8437756-6ccb-4ad7-90f2-9fcefd8fa649.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8437756-6ccb-4ad7-90f2-9fcefd8fa649.tmp
                                                                                                    • Size 11KB
                                                                                                    • SHA256 7a54071e67151113101c3cf02b52803b3d80e44c9755d8a03ed21b0375b32f67
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    dd5fc9a7-6bf6-438b-aad9-df32496fdeb1.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd5fc9a7-6bf6-438b-aad9-df32496fdeb1.tmp
                                                                                                    • Size 12KB
                                                                                                    • SHA256 ee384922d78c0359809c564d01f790ccb55df7a394bf4b3dab891a993280ec3d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OperationConfig
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                    • Size 18KB
                                                                                                    • SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    a2616515-5fa4-4b5a-91b0-4ba50029fb3a.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2616515-5fa4-4b5a-91b0-4ba50029fb3a.tmp
                                                                                                    • Size 34KB
                                                                                                    • SHA256 f6d702a21cf59309dda3bbc44e27f948bfdef776ba1ed4ae4e624af9975ad9c9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    174331a1-e3f1-4ff9-9579-5236a5492a60.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\174331a1-e3f1-4ff9-9579-5236a5492a60.tmp
                                                                                                    • Size 372B
                                                                                                    • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    2f32fa52-06ce-4581-8d3d-6f0d6285d884.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2f32fa52-06ce-4581-8d3d-6f0d6285d884.tmp
                                                                                                    • Size 132B
                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    8ae84a22-e292-4573-917b-f01e5205922a.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8ae84a22-e292-4573-917b-f01e5205922a.tmp
                                                                                                    • Size 252B
                                                                                                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    69e5fd31-9f07-46ec-b0be-0c66dfe13ef2.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69e5fd31-9f07-46ec-b0be-0c66dfe13ef2.tmp
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    hao.360[1].xml
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GSRXBJV5\hao.360[1].xml
                                                                                                    • Size 666B
                                                                                                    • SHA256 2256c417ce3e5cf3cbfe56f74445a910da00fea30a0edd692673e3adb4a40413
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    hao.360[1].xml
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GSRXBJV5\hao.360[1].xml
                                                                                                    • Size 2KB
                                                                                                    • SHA256 adba6d212142f25a376bf6ef87f3304e3ba3ba115d6f5f2e09f8352080c4888c
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    hao.360[1].xml
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GSRXBJV5\hao.360[1].xml
                                                                                                    • Size 2KB
                                                                                                    • SHA256 eec71c014f0d04fc73f1caa21cfa432f2a8b8472da662e5260e82dc9f8d79d0c
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    hao.360[1].xml
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GSRXBJV5\hao.360[1].xml
                                                                                                    • Size 7KB
                                                                                                    • SHA256 e1fe2cf80cb3339a9551c9102b218f7adaa9b9e6088b45a2314d5dc296e68889
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    0[1].png
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3CC7WCI9\0[1].png
                                                                                                    • Size 574B
                                                                                                    • SHA256 5c25da0b9aba170077d3cc5b9e162b110e93435146239441c3d1fd01eedb03fe
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    113[1].js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3CC7WCI9\113[1].js
                                                                                                    • Size 61KB
                                                                                                    • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    QHCmHelp1.0.0.1[1].cab
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MTNU6HGG\QHCmHelp1.0.0.1[1].cab
                                                                                                    • Size 199KB
                                                                                                    • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    time[1].js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q6S6RFLH\time[1].js
                                                                                                    • Size 27B
                                                                                                    • SHA256 eac606adebd5b11320ed87e2a97ab0d1366d66b85eba898ac2e1975b5dd0a6c6
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    sed_api_weather_info[1].htm
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T7KVIYDE\sed_api_weather_info[1].htm
                                                                                                    • Size 7KB
                                                                                                    • SHA256 c1ed9e367970301fc53980337eb470c59ad3a0d4bed7e403d35f5cfd78937e4a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    9c88b4ae-60f8-4968-933c-816b8d4c9b65.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9c88b4ae-60f8-4968-933c-816b8d4c9b65.tmp
                                                                                                    • Size 1B
                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    QHComHelper.inf
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CabFE1D\QHComHelper.inf
                                                                                                    • Size 235B
                                                                                                    • SHA256 75cf96523bdae2e83d6695177301a8b44a6dbbfa924e77dac65c42ae218a6cf2
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    a7731abc-517b-4ff5-9fa4-c6475b0056c1.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\a7731abc-517b-4ff5-9fa4-c6475b0056c1.tmp
                                                                                                    • Size 10KB
                                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    ldsajdklsajdlkjsalkda.bat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                    • Size 589B
                                                                                                    • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    okgmhz.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\okgmhz.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 74161eb435088ced555f0b4673c73019ebd5cb4d9dcbd8b335ff758be3815f7e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    content.js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir996_831701640\CRX_INSTALL\content.js
                                                                                                    • Size 9KB
                                                                                                    • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    054998.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\054998.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 6139c24e82ad3a24c64c41fd1e9e183952dcf5a23ad8393287aeacd6e3aa25ae
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    072618.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\072618.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 9a722d6bb886044beb70a24eac8b52c256e082e72ba62cba8edb329c8d4e378f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    118223.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\118223.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 9d21a3b3f0fa803361ae50009efb8123cbc176339a89bb17a4bd3d10df1c0df4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    315957.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\315957.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 6ce205fef5fb931522d7758312419d3098376375ebb0db070321dc976ab38277
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    328210.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\328210.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 f654bea5e9cc44f28fd3879f28f27bd6678ac351ee6ad68d26aeebb948eb0b41
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    501070.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\501070.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 fcd90874cd03e5664d4fdee79f1d7e283d9a6f83e19588d73a15c1dc7bb0206f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    600402.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\600402.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 73ea2564bdd3be3ab7f2f59ea2496cd98756e289cfe62b44c8e251aaf3ee8b89
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    616612.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\616612.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 9d777612d922b7f8d842786f0e3c8524492c88286cc7695c7f264950e4bbca72
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    673569.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\673569.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 78bcafd22c9e984f88da24615d97ce26a9d7f9829261f99d55e2b217e1bfab62
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    812738.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\812738.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 ba1b8081e9010a26b6a6c4d33b3a0b6469d80cf7220a05fd35b6914b6382f8da
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    860979.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\860979.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 b5c56e4ca2422a065f61f6f120f5aa0a96e3ed147b8ca77f91be1fef02cb55bb
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    905830.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\905830.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 5eb926f80592ffea30a137bc1e0d6cd09a6de4ebb5fc8cba62dd8015ea0d1133
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    912466.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\912466.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 a36d05780ba197c9df824b97e0cae5929172eb43a66ac3a575f10960230a5fc8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    957019.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Download\957019.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 0b5d7a4ed913d9a989f15ece69ee169f88d1c85ba5abbb23d8dc210b9284adc4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping996_107876429\manifest.json
                                                                                                    • Size 135B
                                                                                                    • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping996_1162737397\manifest.json
                                                                                                    • Size 43B
                                                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping996_1511894903\manifest.json
                                                                                                    • Size 160B
                                                                                                    • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping996_920280303\manifest.json
                                                                                                    • Size 165B
                                                                                                    • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    memory/1120-112-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-945-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1064-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1109-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-612-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1156-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1001-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1201-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-905-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1238-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-239-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1284-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-1323-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2540-722-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                    Download