Overview

overview

7

Static

static

3

2026-10-19...op.exe

windows10-2004-x64

7

2026-10-19...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    111s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 10:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261020-mxff2agw91
  • SHA256 cd42b628fa5ee9f8158f29a50db55641acba8f91e09921cc0f6363be84a140d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies registry class 62 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:5212
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:252
    • C:\Users\Admin\AppData\Local\Temp\twliig.exe
      "C:\Users\Admin\AppData\Local\Temp\twliig.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5840
      • C:\Users\Admin\AppData\Local\Temp\twliig.exe
        "C:\Users\Admin\AppData\Local\Temp\twliig.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Users\Admin\AppData\Roaming\Download\307596.exe
          "C:\Users\Admin\AppData\Roaming\Download\307596.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Users\Admin\AppData\Roaming\Download\307596.exe
            "C:\Users\Admin\AppData\Roaming\Download\307596.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1364
        • C:\Users\Admin\AppData\Roaming\Download\165449.exe
          "C:\Users\Admin\AppData\Roaming\Download\165449.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1308
          • C:\Users\Admin\AppData\Roaming\Download\165449.exe
            "C:\Users\Admin\AppData\Roaming\Download\165449.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5588
        • C:\Users\Admin\AppData\Roaming\Download\914326.exe
          "C:\Users\Admin\AppData\Roaming\Download\914326.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Users\Admin\AppData\Roaming\Download\914326.exe
            "C:\Users\Admin\AppData\Roaming\Download\914326.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5372
        • C:\Users\Admin\AppData\Roaming\Download\418837.exe
          "C:\Users\Admin\AppData\Roaming\Download\418837.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Users\Admin\AppData\Roaming\Download\418837.exe
            "C:\Users\Admin\AppData\Roaming\Download\418837.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2976
        • C:\Users\Admin\AppData\Roaming\Download\767734.exe
          "C:\Users\Admin\AppData\Roaming\Download\767734.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Users\Admin\AppData\Roaming\Download\767734.exe
            "C:\Users\Admin\AppData\Roaming\Download\767734.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5292
        • C:\Users\Admin\AppData\Roaming\Download\501070.exe
          "C:\Users\Admin\AppData\Roaming\Download\501070.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:616
          • C:\Users\Admin\AppData\Roaming\Download\501070.exe
            "C:\Users\Admin\AppData\Roaming\Download\501070.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4664
        • C:\Users\Admin\AppData\Roaming\Download\991794.exe
          "C:\Users\Admin\AppData\Roaming\Download\991794.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\Users\Admin\AppData\Roaming\Download\991794.exe
            "C:\Users\Admin\AppData\Roaming\Download\991794.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5472
        • C:\Users\Admin\AppData\Roaming\Download\905830.exe
          "C:\Users\Admin\AppData\Roaming\Download\905830.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1532
          • C:\Users\Admin\AppData\Roaming\Download\905830.exe
            "C:\Users\Admin\AppData\Roaming\Download\905830.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2684
        • C:\Users\Admin\AppData\Roaming\Download\741286.exe
          "C:\Users\Admin\AppData\Roaming\Download\741286.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3808
          • C:\Users\Admin\AppData\Roaming\Download\741286.exe
            "C:\Users\Admin\AppData\Roaming\Download\741286.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6028
        • C:\Users\Admin\AppData\Roaming\Download\735643.exe
          "C:\Users\Admin\AppData\Roaming\Download\735643.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:6032
          • C:\Users\Admin\AppData\Roaming\Download\735643.exe
            "C:\Users\Admin\AppData\Roaming\Download\735643.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5348
        • C:\Users\Admin\AppData\Roaming\Download\277172.exe
          "C:\Users\Admin\AppData\Roaming\Download\277172.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1376
          • C:\Users\Admin\AppData\Roaming\Download\277172.exe
            "C:\Users\Admin\AppData\Roaming\Download\277172.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4228
        • C:\Users\Admin\AppData\Roaming\Download\571248.exe
          "C:\Users\Admin\AppData\Roaming\Download\571248.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3304
          • C:\Users\Admin\AppData\Roaming\Download\571248.exe
            "C:\Users\Admin\AppData\Roaming\Download\571248.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1152
        • C:\Users\Admin\AppData\Roaming\Download\115684.exe
          "C:\Users\Admin\AppData\Roaming\Download\115684.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1712
          • C:\Users\Admin\AppData\Roaming\Download\115684.exe
            "C:\Users\Admin\AppData\Roaming\Download\115684.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5344
        • C:\Users\Admin\AppData\Roaming\Download\121731.exe
          "C:\Users\Admin\AppData\Roaming\Download\121731.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2496
          • C:\Users\Admin\AppData\Roaming\Download\121731.exe
            "C:\Users\Admin\AppData\Roaming\Download\121731.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5536
        • C:\Users\Admin\AppData\Roaming\Download\709444.exe
          "C:\Users\Admin\AppData\Roaming\Download\709444.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3288
          • C:\Users\Admin\AppData\Roaming\Download\709444.exe
            "C:\Users\Admin\AppData\Roaming\Download\709444.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2160
        • C:\Users\Admin\AppData\Roaming\Download\365789.exe
          "C:\Users\Admin\AppData\Roaming\Download\365789.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3972
          • C:\Users\Admin\AppData\Roaming\Download\365789.exe
            "C:\Users\Admin\AppData\Roaming\Download\365789.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2204
        • C:\Users\Admin\AppData\Roaming\Download\727503.exe
          "C:\Users\Admin\AppData\Roaming\Download\727503.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4552
          • C:\Users\Admin\AppData\Roaming\Download\727503.exe
            "C:\Users\Admin\AppData\Roaming\Download\727503.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2072
        • C:\Users\Admin\AppData\Roaming\Download\296117.exe
          "C:\Users\Admin\AppData\Roaming\Download\296117.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5152
          • C:\Users\Admin\AppData\Roaming\Download\296117.exe
            "C:\Users\Admin\AppData\Roaming\Download\296117.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3044
        • C:\Users\Admin\AppData\Roaming\Download\686812.exe
          "C:\Users\Admin\AppData\Roaming\Download\686812.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3224
          • C:\Users\Admin\AppData\Roaming\Download\686812.exe
            "C:\Users\Admin\AppData\Roaming\Download\686812.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5672
        • C:\Users\Admin\AppData\Roaming\Download\690179.exe
          "C:\Users\Admin\AppData\Roaming\Download\690179.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:364
          • C:\Users\Admin\AppData\Roaming\Download\690179.exe
            "C:\Users\Admin\AppData\Roaming\Download\690179.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2400
        • C:\Users\Admin\AppData\Roaming\Download\194508.exe
          "C:\Users\Admin\AppData\Roaming\Download\194508.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5344
          • C:\Users\Admin\AppData\Roaming\Download\194508.exe
            "C:\Users\Admin\AppData\Roaming\Download\194508.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4164
        • C:\Users\Admin\AppData\Roaming\Download\386400.exe
          "C:\Users\Admin\AppData\Roaming\Download\386400.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3428
          • C:\Users\Admin\AppData\Roaming\Download\386400.exe
            "C:\Users\Admin\AppData\Roaming\Download\386400.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2800
        • C:\Users\Admin\AppData\Roaming\Download\913638.exe
          "C:\Users\Admin\AppData\Roaming\Download\913638.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1124
          • C:\Users\Admin\AppData\Roaming\Download\913638.exe
            "C:\Users\Admin\AppData\Roaming\Download\913638.exe"
            5⤵
            • Executes dropped EXE
            PID:2836
        • C:\Users\Admin\AppData\Roaming\Download\518163.exe
          "C:\Users\Admin\AppData\Roaming\Download\518163.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4828
          • C:\Users\Admin\AppData\Roaming\Download\518163.exe
            "C:\Users\Admin\AppData\Roaming\Download\518163.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2508
        • C:\Users\Admin\AppData\Roaming\Download\212692.exe
          "C:\Users\Admin\AppData\Roaming\Download\212692.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2444
          • C:\Users\Admin\AppData\Roaming\Download\212692.exe
            "C:\Users\Admin\AppData\Roaming\Download\212692.exe"
            5⤵
            • Executes dropped EXE
            PID:1980
        • C:\Users\Admin\AppData\Roaming\Download\612306.exe
          "C:\Users\Admin\AppData\Roaming\Download\612306.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3868
          • C:\Users\Admin\AppData\Roaming\Download\612306.exe
            "C:\Users\Admin\AppData\Roaming\Download\612306.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4628
        • C:\Users\Admin\AppData\Roaming\Download\114837.exe
          "C:\Users\Admin\AppData\Roaming\Download\114837.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2400
          • C:\Users\Admin\AppData\Roaming\Download\114837.exe
            "C:\Users\Admin\AppData\Roaming\Download\114837.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5544
        • C:\Users\Admin\AppData\Roaming\Download\430818.exe
          "C:\Users\Admin\AppData\Roaming\Download\430818.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3456
          • C:\Users\Admin\AppData\Roaming\Download\430818.exe
            "C:\Users\Admin\AppData\Roaming\Download\430818.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1776
        • C:\Users\Admin\AppData\Roaming\Download\830402.exe
          "C:\Users\Admin\AppData\Roaming\Download\830402.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:892
          • C:\Users\Admin\AppData\Roaming\Download\830402.exe
            "C:\Users\Admin\AppData\Roaming\Download\830402.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6052
        • C:\Users\Admin\AppData\Roaming\Download\121116.exe
          "C:\Users\Admin\AppData\Roaming\Download\121116.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2248
          • C:\Users\Admin\AppData\Roaming\Download\121116.exe
            "C:\Users\Admin\AppData\Roaming\Download\121116.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1916
        • C:\Users\Admin\AppData\Roaming\Download\435584.exe
          "C:\Users\Admin\AppData\Roaming\Download\435584.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2152
          • C:\Users\Admin\AppData\Roaming\Download\435584.exe
            "C:\Users\Admin\AppData\Roaming\Download\435584.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5244
        • C:\Users\Admin\AppData\Roaming\Download\939013.exe
          "C:\Users\Admin\AppData\Roaming\Download\939013.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2852
          • C:\Users\Admin\AppData\Roaming\Download\939013.exe
            "C:\Users\Admin\AppData\Roaming\Download\939013.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3080
        • C:\Users\Admin\AppData\Roaming\Download\329727.exe
          "C:\Users\Admin\AppData\Roaming\Download\329727.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2804
          • C:\Users\Admin\AppData\Roaming\Download\329727.exe
            "C:\Users\Admin\AppData\Roaming\Download\329727.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2768
        • C:\Users\Admin\AppData\Roaming\Download\455689.exe
          "C:\Users\Admin\AppData\Roaming\Download\455689.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2452
          • C:\Users\Admin\AppData\Roaming\Download\455689.exe
            "C:\Users\Admin\AppData\Roaming\Download\455689.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1064
        • C:\Users\Admin\AppData\Roaming\Download\701670.exe
          "C:\Users\Admin\AppData\Roaming\Download\701670.exe" /Shorttailedrestart
          4⤵
            PID:1104
            • C:\Users\Admin\AppData\Roaming\Download\701670.exe
              "C:\Users\Admin\AppData\Roaming\Download\701670.exe"
              5⤵
                PID:3604
            • C:\Users\Admin\AppData\Roaming\Download\957852.exe
              "C:\Users\Admin\AppData\Roaming\Download\957852.exe" /Shorttailedrestart
              4⤵
                PID:4680
                • C:\Users\Admin\AppData\Roaming\Download\957852.exe
                  "C:\Users\Admin\AppData\Roaming\Download\957852.exe"
                  5⤵
                    PID:3220
                • C:\Users\Admin\AppData\Roaming\Download\325467.exe
                  "C:\Users\Admin\AppData\Roaming\Download\325467.exe" /Shorttailedrestart
                  4⤵
                    PID:6088
                    • C:\Users\Admin\AppData\Roaming\Download\325467.exe
                      "C:\Users\Admin\AppData\Roaming\Download\325467.exe"
                      5⤵
                        PID:4660
                    • C:\Users\Admin\AppData\Roaming\Download\180803.exe
                      "C:\Users\Admin\AppData\Roaming\Download\180803.exe" /Shorttailedrestart
                      4⤵
                        PID:1296
                        • C:\Users\Admin\AppData\Roaming\Download\180803.exe
                          "C:\Users\Admin\AppData\Roaming\Download\180803.exe"
                          5⤵
                            PID:4376
                        • C:\Users\Admin\AppData\Roaming\Download\684231.exe
                          "C:\Users\Admin\AppData\Roaming\Download\684231.exe" /Shorttailedrestart
                          4⤵
                            PID:5604
                            • C:\Users\Admin\AppData\Roaming\Download\684231.exe
                              "C:\Users\Admin\AppData\Roaming\Download\684231.exe"
                              5⤵
                                PID:4460
                            • C:\Users\Admin\AppData\Roaming\Download\679589.exe
                              "C:\Users\Admin\AppData\Roaming\Download\679589.exe" /Shorttailedrestart
                              4⤵
                                PID:3152
                                • C:\Users\Admin\AppData\Roaming\Download\679589.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\679589.exe"
                                  5⤵
                                    PID:4436
                                • C:\Users\Admin\AppData\Roaming\Download\924561.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\924561.exe" /Shorttailedrestart
                                  4⤵
                                    PID:2752
                                    • C:\Users\Admin\AppData\Roaming\Download\924561.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\924561.exe"
                                      5⤵
                                        PID:6108
                                    • C:\Users\Admin\AppData\Roaming\Download\315176.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\315176.exe" /Shorttailedrestart
                                      4⤵
                                        PID:2812
                                        • C:\Users\Admin\AppData\Roaming\Download\315176.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\315176.exe"
                                          5⤵
                                            PID:3128
                                        • C:\Users\Admin\AppData\Roaming\Download\920521.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\920521.exe" /Shorttailedrestart
                                          4⤵
                                            PID:3116
                                            • C:\Users\Admin\AppData\Roaming\Download\920521.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\920521.exe"
                                              5⤵
                                                PID:2468
                                            • C:\Users\Admin\AppData\Roaming\Download\511215.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\511215.exe" /Shorttailedrestart
                                              4⤵
                                                PID:3080
                                                • C:\Users\Admin\AppData\Roaming\Download\511215.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\511215.exe"
                                                  5⤵
                                                    PID:4108
                                                • C:\Users\Admin\AppData\Roaming\Download\911938.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\911938.exe" /Shorttailedrestart
                                                  4⤵
                                                    PID:2584
                                                    • C:\Users\Admin\AppData\Roaming\Download\911938.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\911938.exe"
                                                      5⤵
                                                        PID:480
                                                    • C:\Users\Admin\AppData\Roaming\Download\200642.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\200642.exe" /Shorttailedrestart
                                                      4⤵
                                                        PID:1872
                                                        • C:\Users\Admin\AppData\Roaming\Download\200642.exe
                                                          "C:\Users\Admin\AppData\Roaming\Download\200642.exe"
                                                          5⤵
                                                            PID:5908
                                                        • C:\Users\Admin\AppData\Roaming\Download\549441.exe
                                                          "C:\Users\Admin\AppData\Roaming\Download\549441.exe" /Shorttailedrestart
                                                          4⤵
                                                            PID:1212
                                                            • C:\Users\Admin\AppData\Roaming\Download\549441.exe
                                                              "C:\Users\Admin\AppData\Roaming\Download\549441.exe"
                                                              5⤵
                                                                PID:4940
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                                          2⤵
                                                          • Drops file in Windows directory
                                                          • Enumerates system info in registry
                                                          • Modifies registry class
                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1056
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff04ffc188,0x7fff04ffc194,0x7fff04ffc1a0
                                                            3⤵
                                                              PID:5268
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,17046160730945146695,13751807092418189569,262144 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
                                                              3⤵
                                                                PID:3212
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,18093101757119691370,12511193948493412942,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:11
                                                                3⤵
                                                                • System Time Discovery
                                                                PID:1988
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,6877167884206851765,10440277442021727916,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
                                                                3⤵
                                                                  PID:2624
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3621349190617818933,2234247550136151200,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                                                  3⤵
                                                                    PID:4896
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,1643696739962376658,2611116565825322686,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
                                                                    3⤵
                                                                      PID:5460
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1984647391048401802,12374716653184372335,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
                                                                      3⤵
                                                                        PID:4120
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9647866382473181720,7501731965735517030,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
                                                                        3⤵
                                                                          PID:4936
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7274797056247256039,9244258699150189678,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                                                          3⤵
                                                                            PID:5780
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9213487479483939420,16445574942545233140,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                                                                            3⤵
                                                                              PID:1012
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4568297461298982005,17438247631614058061,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                                                                              3⤵
                                                                                PID:1688
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,4692547000757328632,16436757234016677900,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
                                                                                3⤵
                                                                                  PID:4092
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,4692547000757328632,16436757234016677900,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
                                                                                  3⤵
                                                                                    PID:2692
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,6942473615227182662,2790589325510366902,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                                    3⤵
                                                                                      PID:3936
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,16614509702851177581,11467734569955554741,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                                                                                      3⤵
                                                                                        PID:2884
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6388,i,16741906650848943253,15607347135827518012,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
                                                                                        3⤵
                                                                                          PID:5676
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,8666808247329529083,17784480656763089709,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
                                                                                          3⤵
                                                                                            PID:4300
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,12666355795747033060,6505387905055542451,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
                                                                                            3⤵
                                                                                              PID:5400
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,12469964734398850883,14538005692377577917,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
                                                                                              3⤵
                                                                                              • Modifies registry class
                                                                                              PID:4784
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,11909145920699666615,7405012207911376215,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:12
                                                                                              3⤵
                                                                                                PID:1644
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6120,i,15942830401106281785,1679502367563079360,2097152 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
                                                                                                3⤵
                                                                                                  PID:3536
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11102311956849289266,6807646605255391511,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:1812
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11015746507320215790,16135135312970136608,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
                                                                                                    3⤵
                                                                                                      PID:5880
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,7673749270622287908,10299057719389030691,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
                                                                                                      3⤵
                                                                                                        PID:2524
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,12245376412912293855,10268295967334464558,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
                                                                                                        3⤵
                                                                                                          PID:5648
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3364205604883074340,1855720959744293472,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:5792
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17736141263526406568,7539695116633732814,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:3024
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,15685891959989450658,6012022787187779195,262144 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:10
                                                                                                              3⤵
                                                                                                                PID:5484
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,18084909470063872232,12186287269940486216,524288 --field-trial-handle=2888,i,3425034376813172488,8599136808150573585,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:4112
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                2⤵
                                                                                                                  PID:2864
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                1⤵
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3632
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:3080
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:2976
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                  1⤵
                                                                                                                    PID:796
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                    1⤵
                                                                                                                      PID:700

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          DouTuDaShi.exe
                                                                                                                          • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                                          • Size 1.1MB
                                                                                                                          • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          251b7403-b6a1-4af2-8a18-a8ff5f67ef6b.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\251b7403-b6a1-4af2-8a18-a8ff5f67ef6b.tmp
                                                                                                                          • Size 40KB
                                                                                                                          • SHA256 924281b1764ea89d4129a29efdb864a6ac517aea1a1a6eb36850deb35c9f8860
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2c1022ff-fba5-4183-890d-1eef178a324c.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c1022ff-fba5-4183-890d-1eef178a324c.tmp
                                                                                                                          • Size 38KB
                                                                                                                          • SHA256 36060b7be0cd2cf668f0acc05dfb44d4d026ba06759235198c9e3022abf99984
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          7b50265c-c0b9-4f82-8979-418131a0d568.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b50265c-c0b9-4f82-8979-418131a0d568.tmp
                                                                                                                          • Size 34KB
                                                                                                                          • SHA256 245490df2cea0acfd8879383d6bf476d1d6d89ee75a4a5ea134f4afb9411fe49
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          7a80b14d-509d-4c37-adfe-82e1b0d6552a.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a80b14d-509d-4c37-adfe-82e1b0d6552a.tmp
                                                                                                                          • Size 12KB
                                                                                                                          • SHA256 ec6a80db84f0e718282dc7d3f18060acf6e44c425299090006cd62447b6def11
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          9ba7380a-3e4b-4a00-b5a2-ab69cc79a7fa.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ba7380a-3e4b-4a00-b5a2-ab69cc79a7fa.tmp
                                                                                                                          • Size 6B
                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          f_00006e
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                                          • Size 61KB
                                                                                                                          • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          f_000077
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                          • Size 48KB
                                                                                                                          • SHA256 b314a4cccd871ec9d9f8dbb069479a3b145e7cc115f8cb173210fa0250ac00dd
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          temp-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                          • Size 4KB
                                                                                                                          • SHA256 1f2eb3d35129fa988a7316bb659fb58ee9a7aa6c9d46cc9eaca140eaf8440e8b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 eb51c99ecc6ad222039f98f897e4973119b59c34fcbe387395b4212f97275759
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          056f6883-f42f-4ea4-9ba5-0823935c3b90.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\056f6883-f42f-4ea4-9ba5-0823935c3b90.tmp
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          dasherSettingSchema.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                                          • Size 854B
                                                                                                                          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          74fea54b-12ef-4947-bbbf-4ebc629b5755.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\74fea54b-12ef-4947-bbbf-4ebc629b5755.tmp
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 4e318ecc41a16c79a2275cf6a9ad14a45c59c2421d7ae05c7c5832b647a7d5d8
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          c74a0ea8-ab79-4808-924c-35701f0d9eab.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c74a0ea8-ab79-4808-924c-35701f0d9eab.tmp
                                                                                                                          • Size 40B
                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          e2ae3156-41e5-436d-af43-bd3b4de5a238.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2ae3156-41e5-436d-af43-bd3b4de5a238.tmp
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 c719abf979aea0176579a98cdbb15049d6b37cc6044e2dabf4f13d959a0b0df7
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          sync_diagnostic.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                          • Size 4KB
                                                                                                                          • SHA256 e10eaef7428a456dfcf8e4c14c3d5d1c00c7101f92b2580cb015201c767bd7a3
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          a3123db1-c2ee-4ab0-b2ec-93031849a553.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3123db1-c2ee-4ab0-b2ec-93031849a553.tmp
                                                                                                                          • Size 70KB
                                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          a69c1503-5856-4ee7-8049-9c21f6ca52ce.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a69c1503-5856-4ee7-8049-9c21f6ca52ce.tmp
                                                                                                                          • Size 13KB
                                                                                                                          • SHA256 aaf0d13a8d39feed09090194006093da40d11aa8cd7aefcd0a53ffe31a46934e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          a8564b4a-4b41-4c42-8ba9-0e7639d4ea62.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8564b4a-4b41-4c42-8ba9-0e7639d4ea62.tmp
                                                                                                                          • Size 29KB
                                                                                                                          • SHA256 cfca612fdb01055c6ceb09e7f33810fcc6e543fe70343c6aff7acb38b02fe4a4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          e65fda03-fb8f-4c25-a8f3-cd26de4a30d7.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e65fda03-fb8f-4c25-a8f3-cd26de4a30d7.tmp
                                                                                                                          • Size 12KB
                                                                                                                          • SHA256 f39d4b4e99bc305261f3eb791a091cf905f9a58daeb0e766e5d49127f5c4826f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          96b4b050-eebc-48ed-a2d3-3c2297fa43c2.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\96b4b050-eebc-48ed-a2d3-3c2297fa43c2.tmp
                                                                                                                          • Size 22KB
                                                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 38KB
                                                                                                                          • SHA256 bb21ecdb3bb2aed8f966adbe4d00ee533ab2d03442210bd68b8e50700c2d299a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          b5909694-f128-4852-892b-fbc49660d2e3.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5909694-f128-4852-892b-fbc49660d2e3.tmp
                                                                                                                          • Size 34KB
                                                                                                                          • SHA256 780d31d003c6fe4032d9447c50c87440f2190167975b54e692899c94cf09fb4c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          1af5b38f-08b1-4cad-b310-5af851ef37f0.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1af5b38f-08b1-4cad-b310-5af851ef37f0.tmp
                                                                                                                          • Size 132B
                                                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          5d720222-447d-40c2-a6ad-75cda3031028.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5d720222-447d-40c2-a6ad-75cda3031028.tmp
                                                                                                                          • Size 252B
                                                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                          • Size 158KB
                                                                                                                          • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          99b9c773-7078-4589-adc7-5a3d8a300342.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\99b9c773-7078-4589-adc7-5a3d8a300342.tmp
                                                                                                                          • Size 13B
                                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                          • Size 132B
                                                                                                                          • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          fb12bb8f-4d95-442b-8d5a-ef5b3136f64a.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb12bb8f-4d95-442b-8d5a-ef5b3136f64a.tmp
                                                                                                                          • Size 42KB
                                                                                                                          • SHA256 03aa78e778e23e885aa5d8fb14314dfd475cbf7d714b7aaec83c8e84e4c6e21d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          hao.360[1].xml
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E9BFRW13\hao.360[1].xml
                                                                                                                          • Size 50KB
                                                                                                                          • SHA256 0d61b938fe77e1c35c527798d5f81aae1bdf98bf0b9ec6918f8e9ec0f130092d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          hao.360[1].xml
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E9BFRW13\hao.360[1].xml
                                                                                                                          • Size 50KB
                                                                                                                          • SHA256 432726203d0d2ed189e6e05e5088b6c8628d01a61baa966c17d9532229ed6a33
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          QHCmHelp1.0.0.1[1].cab
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CF6EWZMM\QHCmHelp1.0.0.1[1].cab
                                                                                                                          • Size 199KB
                                                                                                                          • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          behavior[1].htm
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FO1SVJOF\behavior[1].htm
                                                                                                                          • Size 43B
                                                                                                                          • SHA256 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          time[1].js
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FO1SVJOF\time[1].js
                                                                                                                          • Size 27B
                                                                                                                          • SHA256 7a56a7122de843f93fee23557198599e255eafeb3e371206713df015e8d1136d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          84d7f4c7-9044-4850-9e54-b6940a1142ac.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\84d7f4c7-9044-4850-9e54-b6940a1142ac.tmp
                                                                                                                          • Size 10KB
                                                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          QHComHelper.inf
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CabC7EA\QHComHelper.inf
                                                                                                                          • Size 235B
                                                                                                                          • SHA256 75cf96523bdae2e83d6695177301a8b44a6dbbfa924e77dac65c42ae218a6cf2
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          QHComHelper.ocx
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\QHComHelper.ocx
                                                                                                                          • Size 371KB
                                                                                                                          • SHA256 da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          a96a2a97-9501-4650-9f9f-76d36275f01c.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a96a2a97-9501-4650-9f9f-76d36275f01c.tmp
                                                                                                                          • Size 1B
                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          ldsajdklsajdlkjsalkda.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                          • Size 589B
                                                                                                                          • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          content.js
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1056_674887076\CRX_INSTALL\content.js
                                                                                                                          • Size 9KB
                                                                                                                          • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          messages.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1056_862941231\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                          • Size 711B
                                                                                                                          • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          twliig.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\twliig.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 cd42b628fa5ee9f8158f29a50db55641acba8f91e09921cc0f6363be84a140d1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          165449.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\165449.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 2ee116bb7b8fe2f860a0f0e571db22148409262d58d5e629c71b4bb55f7595a6
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          277172.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\277172.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 3dae2c9ed401e063aac5cb02e20f7d26c0e8afcbf454e6349f7e8414a790f527
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          307596.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\307596.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 8bbea79a3564274ab709bfe572f61f335467dfe8131cddf311c3bba054ffeedf
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          418837.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\418837.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 299352ce4c7c09488e0e43c9ac4cb90f63dea9f784f15d0d375aee34a6b4d133
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          501070.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\501070.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 3d17f16840f20ec0d106f1a41b8c9d540019a8e43d1c262378c1201bd81f1742
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          571248.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\571248.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 575e3487a73d49ac459e720bf1b8cf4cdd6bf6257487aec9edf649304ec1cf25
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          735643.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\735643.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 aa6d0cf015d7b9eaa8cc6c8e124dc57f141cb6507eb8ec43b821f78f2f56524c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          741286.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\741286.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 2c8214b0b450071669c4b033fa11b524f9e9a720fb1551ecdc1dc5f8c8238b4b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          767734.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\767734.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 8bbb71dbc69f607fdb3e1af2b21cc99752a1e761a243946f81809c6e14d368bc
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          905830.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\905830.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 397b286be7067624e992f7d97781f8c50ab32d10688857c2722ca70d7bbd0cf2
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          914326.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\914326.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 4aafbcb758f99f93d1ba829fbbf6a6a160a918295f78040d231d165895270c9e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          991794.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Download\991794.exe
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 c71494969218b7aad8a6611b130b2add956bf8239d49d2e6b2cfed39a69085ce
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1056_1136356233\manifest.json
                                                                                                                          • Size 160B
                                                                                                                          • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1056_1647098035\manifest.json
                                                                                                                          • Size 43B
                                                                                                                          • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1056_53235190\manifest.json
                                                                                                                          • Size 135B
                                                                                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/2692-930-0x0000015FA82E0000-0x0000015FA8521000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1079-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1546-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1281-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1220-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1323-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1140-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-935-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-358-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1387-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1416-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1177-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1453-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-995-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3268-1506-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5212-133-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5840-20-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                          Download