Overview

overview

7

Static

static

3

2026-11-07...op.exe

windows10-2004-x64

7

2026-11-07...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-07_9dfe2dad1f7399a26cc9388c0530e718_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample261107-nvzybsxt8k
  • SHA256 edafa43689b1e0be1ddc2c9139b701c512576924bf7cabdd2f3d1165c23583a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-07_9dfe2dad1f7399a26cc9388c0530e718_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-07_9dfe2dad1f7399a26cc9388c0530e718_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:3376
    • C:\Users\Admin\AppData\Local\Temp\boslps.exe
      "C:\Users\Admin\AppData\Local\Temp\boslps.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Users\Admin\AppData\Local\Temp\boslps.exe
        "C:\Users\Admin\AppData\Local\Temp\boslps.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Users\Admin\AppData\Roaming\Download\866939.exe
          "C:\Users\Admin\AppData\Roaming\Download\866939.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:108
          • C:\Users\Admin\AppData\Roaming\Download\866939.exe
            "C:\Users\Admin\AppData\Roaming\Download\866939.exe"
            5⤵
            • Executes dropped EXE
            PID:4836
        • C:\Users\Admin\AppData\Roaming\Download\283444.exe
          "C:\Users\Admin\AppData\Roaming\Download\283444.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:984
          • C:\Users\Admin\AppData\Roaming\Download\283444.exe
            "C:\Users\Admin\AppData\Roaming\Download\283444.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5460
        • C:\Users\Admin\AppData\Roaming\Download\684156.exe
          "C:\Users\Admin\AppData\Roaming\Download\684156.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Users\Admin\AppData\Roaming\Download\684156.exe
            "C:\Users\Admin\AppData\Roaming\Download\684156.exe"
            5⤵
            • Executes dropped EXE
            PID:4736
        • C:\Users\Admin\AppData\Roaming\Download\017105.exe
          "C:\Users\Admin\AppData\Roaming\Download\017105.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Users\Admin\AppData\Roaming\Download\017105.exe
            "C:\Users\Admin\AppData\Roaming\Download\017105.exe"
            5⤵
            • Executes dropped EXE
            PID:5340
        • C:\Users\Admin\AppData\Roaming\Download\566092.exe
          "C:\Users\Admin\AppData\Roaming\Download\566092.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Admin\AppData\Roaming\Download\566092.exe
            "C:\Users\Admin\AppData\Roaming\Download\566092.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4188
        • C:\Users\Admin\AppData\Roaming\Download\338159.exe
          "C:\Users\Admin\AppData\Roaming\Download\338159.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Users\Admin\AppData\Roaming\Download\338159.exe
            "C:\Users\Admin\AppData\Roaming\Download\338159.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3128
        • C:\Users\Admin\AppData\Roaming\Download\888740.exe
          "C:\Users\Admin\AppData\Roaming\Download\888740.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Users\Admin\AppData\Roaming\Download\888740.exe
            "C:\Users\Admin\AppData\Roaming\Download\888740.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5856
        • C:\Users\Admin\AppData\Roaming\Download\206274.exe
          "C:\Users\Admin\AppData\Roaming\Download\206274.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3812
          • C:\Users\Admin\AppData\Roaming\Download\206274.exe
            "C:\Users\Admin\AppData\Roaming\Download\206274.exe"
            5⤵
            • Executes dropped EXE
            PID:3128
        • C:\Users\Admin\AppData\Roaming\Download\555053.exe
          "C:\Users\Admin\AppData\Roaming\Download\555053.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5976
          • C:\Users\Admin\AppData\Roaming\Download\555053.exe
            "C:\Users\Admin\AppData\Roaming\Download\555053.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3764
        • C:\Users\Admin\AppData\Roaming\Download\681036.exe
          "C:\Users\Admin\AppData\Roaming\Download\681036.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2928
          • C:\Users\Admin\AppData\Roaming\Download\681036.exe
            "C:\Users\Admin\AppData\Roaming\Download\681036.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2456
        • C:\Users\Admin\AppData\Roaming\Download\071750.exe
          "C:\Users\Admin\AppData\Roaming\Download\071750.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5152
          • C:\Users\Admin\AppData\Roaming\Download\071750.exe
            "C:\Users\Admin\AppData\Roaming\Download\071750.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6112
        • C:\Users\Admin\AppData\Roaming\Download\327830.exe
          "C:\Users\Admin\AppData\Roaming\Download\327830.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1936
          • C:\Users\Admin\AppData\Roaming\Download\327830.exe
            "C:\Users\Admin\AppData\Roaming\Download\327830.exe"
            5⤵
            • Executes dropped EXE
            PID:3296
        • C:\Users\Admin\AppData\Roaming\Download\553813.exe
          "C:\Users\Admin\AppData\Roaming\Download\553813.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4948
          • C:\Users\Admin\AppData\Roaming\Download\553813.exe
            "C:\Users\Admin\AppData\Roaming\Download\553813.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5072
        • C:\Users\Admin\AppData\Roaming\Download\609896.exe
          "C:\Users\Admin\AppData\Roaming\Download\609896.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1424
          • C:\Users\Admin\AppData\Roaming\Download\609896.exe
            "C:\Users\Admin\AppData\Roaming\Download\609896.exe"
            5⤵
            • Executes dropped EXE
            PID:3880
        • C:\Users\Admin\AppData\Roaming\Download\054958.exe
          "C:\Users\Admin\AppData\Roaming\Download\054958.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5536
          • C:\Users\Admin\AppData\Roaming\Download\054958.exe
            "C:\Users\Admin\AppData\Roaming\Download\054958.exe"
            5⤵
            • Executes dropped EXE
            PID:5892
        • C:\Users\Admin\AppData\Roaming\Download\180931.exe
          "C:\Users\Admin\AppData\Roaming\Download\180931.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4936
          • C:\Users\Admin\AppData\Roaming\Download\180931.exe
            "C:\Users\Admin\AppData\Roaming\Download\180931.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5516
        • C:\Users\Admin\AppData\Roaming\Download\571645.exe
          "C:\Users\Admin\AppData\Roaming\Download\571645.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1820
          • C:\Users\Admin\AppData\Roaming\Download\571645.exe
            "C:\Users\Admin\AppData\Roaming\Download\571645.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3648
        • C:\Users\Admin\AppData\Roaming\Download\826525.exe
          "C:\Users\Admin\AppData\Roaming\Download\826525.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2692
          • C:\Users\Admin\AppData\Roaming\Download\826525.exe
            "C:\Users\Admin\AppData\Roaming\Download\826525.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:368
        • C:\Users\Admin\AppData\Roaming\Download\460971.exe
          "C:\Users\Admin\AppData\Roaming\Download\460971.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5352
          • C:\Users\Admin\AppData\Roaming\Download\460971.exe
            "C:\Users\Admin\AppData\Roaming\Download\460971.exe"
            5⤵
            • Executes dropped EXE
            PID:4968
        • C:\Users\Admin\AppData\Roaming\Download\964502.exe
          "C:\Users\Admin\AppData\Roaming\Download\964502.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1416
          • C:\Users\Admin\AppData\Roaming\Download\964502.exe
            "C:\Users\Admin\AppData\Roaming\Download\964502.exe"
            5⤵
            • Executes dropped EXE
            PID:2408
        • C:\Users\Admin\AppData\Roaming\Download\413379.exe
          "C:\Users\Admin\AppData\Roaming\Download\413379.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2456
          • C:\Users\Admin\AppData\Roaming\Download\413379.exe
            "C:\Users\Admin\AppData\Roaming\Download\413379.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5508
        • C:\Users\Admin\AppData\Roaming\Download\548552.exe
          "C:\Users\Admin\AppData\Roaming\Download\548552.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1724
          • C:\Users\Admin\AppData\Roaming\Download\548552.exe
            "C:\Users\Admin\AppData\Roaming\Download\548552.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6024
        • C:\Users\Admin\AppData\Roaming\Download\794444.exe
          "C:\Users\Admin\AppData\Roaming\Download\794444.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4808
          • C:\Users\Admin\AppData\Roaming\Download\794444.exe
            "C:\Users\Admin\AppData\Roaming\Download\794444.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2316
        • C:\Users\Admin\AppData\Roaming\Download\337888.exe
          "C:\Users\Admin\AppData\Roaming\Download\337888.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3296
          • C:\Users\Admin\AppData\Roaming\Download\337888.exe
            "C:\Users\Admin\AppData\Roaming\Download\337888.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1312
        • C:\Users\Admin\AppData\Roaming\Download\683861.exe
          "C:\Users\Admin\AppData\Roaming\Download\683861.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1368
          • C:\Users\Admin\AppData\Roaming\Download\683861.exe
            "C:\Users\Admin\AppData\Roaming\Download\683861.exe"
            5⤵
            • Executes dropped EXE
            PID:2072
        • C:\Users\Admin\AppData\Roaming\Download\932660.exe
          "C:\Users\Admin\AppData\Roaming\Download\932660.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4560
          • C:\Users\Admin\AppData\Roaming\Download\932660.exe
            "C:\Users\Admin\AppData\Roaming\Download\932660.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4968
        • C:\Users\Admin\AppData\Roaming\Download\577006.exe
          "C:\Users\Admin\AppData\Roaming\Download\577006.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4592
          • C:\Users\Admin\AppData\Roaming\Download\577006.exe
            "C:\Users\Admin\AppData\Roaming\Download\577006.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3092
        • C:\Users\Admin\AppData\Roaming\Download\762152.exe
          "C:\Users\Admin\AppData\Roaming\Download\762152.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5404
          • C:\Users\Admin\AppData\Roaming\Download\762152.exe
            "C:\Users\Admin\AppData\Roaming\Download\762152.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2672
        • C:\Users\Admin\AppData\Roaming\Download\439574.exe
          "C:\Users\Admin\AppData\Roaming\Download\439574.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3764
          • C:\Users\Admin\AppData\Roaming\Download\439574.exe
            "C:\Users\Admin\AppData\Roaming\Download\439574.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1260
        • C:\Users\Admin\AppData\Roaming\Download\820198.exe
          "C:\Users\Admin\AppData\Roaming\Download\820198.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2420
          • C:\Users\Admin\AppData\Roaming\Download\820198.exe
            "C:\Users\Admin\AppData\Roaming\Download\820198.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3332
        • C:\Users\Admin\AppData\Roaming\Download\217186.exe
          "C:\Users\Admin\AppData\Roaming\Download\217186.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:432
          • C:\Users\Admin\AppData\Roaming\Download\217186.exe
            "C:\Users\Admin\AppData\Roaming\Download\217186.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1352
        • C:\Users\Admin\AppData\Roaming\Download\025238.exe
          "C:\Users\Admin\AppData\Roaming\Download\025238.exe" /Shorttailedrestart
          4⤵
            PID:5028
            • C:\Users\Admin\AppData\Roaming\Download\025238.exe
              "C:\Users\Admin\AppData\Roaming\Download\025238.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4304
          • C:\Users\Admin\AppData\Roaming\Download\171210.exe
            "C:\Users\Admin\AppData\Roaming\Download\171210.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2112
            • C:\Users\Admin\AppData\Roaming\Download\171210.exe
              "C:\Users\Admin\AppData\Roaming\Download\171210.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2744
          • C:\Users\Admin\AppData\Roaming\Download\751923.exe
            "C:\Users\Admin\AppData\Roaming\Download\751923.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2564
            • C:\Users\Admin\AppData\Roaming\Download\751923.exe
              "C:\Users\Admin\AppData\Roaming\Download\751923.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4268
          • C:\Users\Admin\AppData\Roaming\Download\807005.exe
            "C:\Users\Admin\AppData\Roaming\Download\807005.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4672
            • C:\Users\Admin\AppData\Roaming\Download\807005.exe
              "C:\Users\Admin\AppData\Roaming\Download\807005.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5132
          • C:\Users\Admin\AppData\Roaming\Download\043088.exe
            "C:\Users\Admin\AppData\Roaming\Download\043088.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1520
            • C:\Users\Admin\AppData\Roaming\Download\043088.exe
              "C:\Users\Admin\AppData\Roaming\Download\043088.exe"
              5⤵
                PID:3528
            • C:\Users\Admin\AppData\Roaming\Download\544702.exe
              "C:\Users\Admin\AppData\Roaming\Download\544702.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3328
              • C:\Users\Admin\AppData\Roaming\Download\544702.exe
                "C:\Users\Admin\AppData\Roaming\Download\544702.exe"
                5⤵
                  PID:6112
              • C:\Users\Admin\AppData\Roaming\Download\934316.exe
                "C:\Users\Admin\AppData\Roaming\Download\934316.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4452
                • C:\Users\Admin\AppData\Roaming\Download\934316.exe
                  "C:\Users\Admin\AppData\Roaming\Download\934316.exe"
                  5⤵
                    PID:3088
                • C:\Users\Admin\AppData\Roaming\Download\160577.exe
                  "C:\Users\Admin\AppData\Roaming\Download\160577.exe" /Shorttailedrestart
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2480
                  • C:\Users\Admin\AppData\Roaming\Download\160577.exe
                    "C:\Users\Admin\AppData\Roaming\Download\160577.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2344
                • C:\Users\Admin\AppData\Roaming\Download\519376.exe
                  "C:\Users\Admin\AppData\Roaming\Download\519376.exe" /Shorttailedrestart
                  4⤵
                    PID:5384
                    • C:\Users\Admin\AppData\Roaming\Download\519376.exe
                      "C:\Users\Admin\AppData\Roaming\Download\519376.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:624
                  • C:\Users\Admin\AppData\Roaming\Download\765359.exe
                    "C:\Users\Admin\AppData\Roaming\Download\765359.exe" /Shorttailedrestart
                    4⤵
                      PID:5056
                      • C:\Users\Admin\AppData\Roaming\Download\765359.exe
                        "C:\Users\Admin\AppData\Roaming\Download\765359.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5036
                    • C:\Users\Admin\AppData\Roaming\Download\308792.exe
                      "C:\Users\Admin\AppData\Roaming\Download\308792.exe" /Shorttailedrestart
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6024
                      • C:\Users\Admin\AppData\Roaming\Download\308792.exe
                        "C:\Users\Admin\AppData\Roaming\Download\308792.exe"
                        5⤵
                          PID:3208
                      • C:\Users\Admin\AppData\Roaming\Download\434775.exe
                        "C:\Users\Admin\AppData\Roaming\Download\434775.exe" /Shorttailedrestart
                        4⤵
                          PID:4280
                          • C:\Users\Admin\AppData\Roaming\Download\434775.exe
                            "C:\Users\Admin\AppData\Roaming\Download\434775.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:3316
                        • C:\Users\Admin\AppData\Roaming\Download\889858.exe
                          "C:\Users\Admin\AppData\Roaming\Download\889858.exe" /Shorttailedrestart
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1560
                          • C:\Users\Admin\AppData\Roaming\Download\889858.exe
                            "C:\Users\Admin\AppData\Roaming\Download\889858.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5724
                        • C:\Users\Admin\AppData\Roaming\Download\935830.exe
                          "C:\Users\Admin\AppData\Roaming\Download\935830.exe" /Shorttailedrestart
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5880
                          • C:\Users\Admin\AppData\Roaming\Download\935830.exe
                            "C:\Users\Admin\AppData\Roaming\Download\935830.exe"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:2872
                        • C:\Users\Admin\AppData\Roaming\Download\306534.exe
                          "C:\Users\Admin\AppData\Roaming\Download\306534.exe" /Shorttailedrestart
                          4⤵
                            PID:2332
                            • C:\Users\Admin\AppData\Roaming\Download\306534.exe
                              "C:\Users\Admin\AppData\Roaming\Download\306534.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1516
                          • C:\Users\Admin\AppData\Roaming\Download\896149.exe
                            "C:\Users\Admin\AppData\Roaming\Download\896149.exe" /Shorttailedrestart
                            4⤵
                              PID:1312
                              • C:\Users\Admin\AppData\Roaming\Download\896149.exe
                                "C:\Users\Admin\AppData\Roaming\Download\896149.exe"
                                5⤵
                                  PID:4284
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                            2⤵
                            • Drops file in Windows directory
                            • Enumerates system info in registry
                            • Modifies registry class
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:2300
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc6d56c188,0x7ffc6d56c194,0x7ffc6d56c1a0
                              3⤵
                                PID:2972
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,14782231397217383266,4435726437880938144,262144 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
                                3⤵
                                  PID:2580
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,12617452313865461379,823969254070891733,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
                                  3⤵
                                  • System Time Discovery
                                  PID:2448
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,12262282035073890699,17605323826847314711,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:13
                                  3⤵
                                    PID:4692
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,1216373401918063946,3647271948716395927,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                                    3⤵
                                      PID:1656
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,12560997798548299945,16657692126811661875,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                                      3⤵
                                        PID:604
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5261015342790069442,2361363820903560798,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
                                        3⤵
                                          PID:4608
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12732966009432531773,9450176331199511200,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
                                          3⤵
                                            PID:3312
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,17120550966309539962,13145116663272730382,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
                                            3⤵
                                              PID:2320
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11113321789719873147,2529295853998750593,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                              3⤵
                                                PID:4776
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,18387262448593083042,8757917992820589500,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
                                                3⤵
                                                  PID:5028
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,10751435307557586110,1877841650416374402,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                                  3⤵
                                                    PID:4676
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,10751435307557586110,1877841650416374402,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                                    3⤵
                                                      PID:5036
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,17618315183414511359,6970428782787684929,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
                                                      3⤵
                                                        PID:4704
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5175633421054002603,6639350074362753900,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
                                                        3⤵
                                                          PID:5368
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13396921007041715257,8303519766137514435,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                          3⤵
                                                            PID:5432
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4284502248005096805,15068991060243097532,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
                                                            3⤵
                                                              PID:4332
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6608,i,15271127434055878637,15497497730318261148,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
                                                              3⤵
                                                                PID:4200
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,6882072582009327461,2872722273292946782,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:12
                                                                3⤵
                                                                  PID:6012
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,2918529754290465991,8359642726030309098,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
                                                                  3⤵
                                                                  • Modifies registry class
                                                                  PID:3624
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3688,i,18233675522371840988,648774074896646384,2097152 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
                                                                  3⤵
                                                                    PID:3256
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7077636690328955875,15317042238491111053,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                    3⤵
                                                                      PID:2216
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1643250562270895684,12521670737702953402,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
                                                                      3⤵
                                                                        PID:2860
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,182147676801251414,13657820869193068199,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
                                                                        3⤵
                                                                          PID:5368
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2555077404020307034,15129719503447737163,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:14
                                                                          3⤵
                                                                            PID:2596
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11339271832761276952,1187665631363021833,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
                                                                            3⤵
                                                                              PID:5836
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1794101289592914311,15841531328657377511,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                                                                              3⤵
                                                                                PID:5900
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5492,i,5315205620604402364,15165558821014417355,262144 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:10
                                                                                3⤵
                                                                                  PID:3284
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3084,i,28302124332402711,12598222365282311450,524288 --field-trial-handle=2240,i,5431956945028101748,12499575177594494087,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
                                                                                  3⤵
                                                                                    PID:6076
                                                                                • C:\Windows\explorer.exe
                                                                                  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                  2⤵
                                                                                    PID:3804
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4612
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                    2⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:2852
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:5512
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                    1⤵
                                                                                      PID:4560
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                      1⤵
                                                                                        PID:5516

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            DouTuDaShi.exe
                                                                                            • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                            • Size 1.1MB
                                                                                            • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            6e5f3c68-f6fe-4c7f-bb70-a6cd2f417df6.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e5f3c68-f6fe-4c7f-bb70-a6cd2f417df6.tmp
                                                                                            • Size 33KB
                                                                                            • SHA256 a1c89a3722f1570868ffb1edad2484821ea8fcab3f43a541eb92c26a5aeadb53
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            72d43d6a-1629-4563-8df2-48b6825364bb.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72d43d6a-1629-4563-8df2-48b6825364bb.tmp
                                                                                            • Size 38KB
                                                                                            • SHA256 521ea820fe1dd85d0b7e7da7a107484238c63bf716f908e0cec31960ce7aff65
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            81b70736-98ad-454b-8b01-d05bed666260.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81b70736-98ad-454b-8b01-d05bed666260.tmp
                                                                                            • Size 33KB
                                                                                            • SHA256 173ac32cdbfb6f7dd8e64bf08984bf2a4bd04c446014b527107ad6ee06376b97
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            8dc1cdb9-a60f-407e-98ad-6e6b6eb064ea.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8dc1cdb9-a60f-407e-98ad-6e6b6eb064ea.tmp
                                                                                            • Size 38KB
                                                                                            • SHA256 1a168adb2fe65e19c54f0a878289be175ecc16b31cd9bde50e14f1237f3298ce
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            de75de2d-a8d0-410e-a9c1-b2ba334c5fef.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\de75de2d-a8d0-410e-a9c1-b2ba334c5fef.tmp
                                                                                            • Size 105KB
                                                                                            • SHA256 53485fcfaed759b3ae05094c9f1150d6e1c50d1a0e9bb27d696de6d6429b7818
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            settings.dat
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                            • Size 280B
                                                                                            • SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            7954549b-a565-4c4a-adfe-c69c7cab0738.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7954549b-a565-4c4a-adfe-c69c7cab0738.tmp
                                                                                            • Size 29KB
                                                                                            • SHA256 e86173fe170c7bb246588c7bf3ea145fffb5c984dbc2d9abc4c4734a10bb60cb
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            8315d0e7-c3c4-49d1-b1ff-eae2622ad7da.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8315d0e7-c3c4-49d1-b1ff-eae2622ad7da.tmp
                                                                                            • Size 13KB
                                                                                            • SHA256 8ca54876444f7cfa9fcf792b175ff2854c923463f4bd20f1b95427d938600d2e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            94cf7c2b-8d50-4d32-990d-ca8de008db2e.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94cf7c2b-8d50-4d32-990d-ca8de008db2e.tmp
                                                                                            • Size 70KB
                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            LOG.old
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                            • Size 331B
                                                                                            • SHA256 dfafe006b6cb02650ed1955546b4383e88cdd6ed4e5509e3617cd80bb6f148ee
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            f_000055
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
                                                                                            • Size 61KB
                                                                                            • SHA256 1e81a239019ef2a026a6cdbcbeccda020c20430e70f956567d0237d72518342c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            temp-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                            • Size 3KB
                                                                                            • SHA256 9c6417fb9eabc38eb658e6ee0faa13e76be460beac99b587a1d35cb76719a73a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            the-real-index
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                            • Size 2KB
                                                                                            • SHA256 3539ef57a50875454b107941155fe4063850cab63c4dc755c5b5189ac2a98b55
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            0df4467d-ec44-4194-a60b-90f212393163.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0df4467d-ec44-4194-a60b-90f212393163.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            dasherSettingSchema.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                            • Size 854B
                                                                                            • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            033b7e1b-a6fe-418e-959c-7699891cc435.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\033b7e1b-a6fe-418e-959c-7699891cc435.tmp
                                                                                            • Size 2B
                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            5b2e5473-9dce-4482-a1f7-bfe1336b86c8.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b2e5473-9dce-4482-a1f7-bfe1336b86c8.tmp
                                                                                            • Size 6KB
                                                                                            • SHA256 814a000b95b5411a853092226d22ae89618295f97dddf48f6572b81d5758dc96
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ec2cf5a6-79e7-4293-bd26-fc2f8f3b02f2.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec2cf5a6-79e7-4293-bd26-fc2f8f3b02f2.tmp
                                                                                            • Size 40B
                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            sync_diagnostic.log
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                            • Size 5KB
                                                                                            • SHA256 e9ff0d4c30336cd4bbc2a8a5788997cd91813fd6d20861be1e3e550c38789f72
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            a57b7543-ea31-4ed8-ac56-40b6bd992f6f.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a57b7543-ea31-4ed8-ac56-40b6bd992f6f.tmp
                                                                                            • Size 13KB
                                                                                            • SHA256 e26f2da88a324ec95cbc7a8363e9366eee779ef9e7b26ce0b3aeed0b734efa37
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c3cc8ccf-4ec7-46d2-a428-f67ddb6bdb4e.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3cc8ccf-4ec7-46d2-a428-f67ddb6bdb4e.tmp
                                                                                            • Size 6B
                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            fdf3df62-4aa8-4c5d-b966-b6ab89ed6bd4.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdf3df62-4aa8-4c5d-b966-b6ab89ed6bd4.tmp
                                                                                            • Size 12KB
                                                                                            • SHA256 ea97cbe418eb4a4e72bc7930ababc3c85cd282affe4de78659ebe2205774e7e4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            d39cd162-ede2-4e2b-820e-6816939ef77e.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d39cd162-ede2-4e2b-820e-6816939ef77e.tmp
                                                                                            • Size 22KB
                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            dafa1d36-167f-4442-8218-0be9971083ce.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dafa1d36-167f-4442-8218-0be9971083ce.tmp
                                                                                            • Size 132B
                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            de7dab2f-5061-4f7d-ae3b-c9ce1fc30b22.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de7dab2f-5061-4f7d-ae3b-c9ce1fc30b22.tmp
                                                                                            • Size 42KB
                                                                                            • SHA256 b83783b6b7072c5e484bcd0534fc7c6945e3ce6bc0aa037847ec3c6a83c518f1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2049745d-ef93-4e68-a3f6-31f3c1700e43.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2049745d-ef93-4e68-a3f6-31f3c1700e43.tmp
                                                                                            • Size 13B
                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                            • Size 158KB
                                                                                            • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            metadata.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                            • Size 132B
                                                                                            • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            fe661016-ec92-4409-91c2-b785241abfdd.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe661016-ec92-4409-91c2-b785241abfdd.tmp
                                                                                            • Size 37KB
                                                                                            • SHA256 f35a4d385a74c0544be5f3f9b24cf302a40d55158af2952e5c778ad28d9fd0c1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\10688QLT\hao.360[1].xml
                                                                                            • Size 2KB
                                                                                            • SHA256 9e05c13a116e377f8f4f059954b7b1654abe8e38c437d973d096f816e6d58481
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\10688QLT\hao.360[1].xml
                                                                                            • Size 50KB
                                                                                            • SHA256 fa3ba333901d90cadb4b1edcd02220937369ace0574d90ee8e1d398abe395a0c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            hao.360[1].xml
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\10688QLT\hao.360[1].xml
                                                                                            • Size 50KB
                                                                                            • SHA256 4ed9a7a4190448b268839dc81b1d0cf10f1c392f9edb006b2cccad76b5c0ea03
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            QHCmHelp1.0.0.1[1].cab
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2NSAMQMS\QHCmHelp1.0.0.1[1].cab
                                                                                            • Size 199KB
                                                                                            • SHA256 b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sed_api_weather_info[1].htm
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8999WJP3\sed_api_weather_info[1].htm
                                                                                            • Size 7KB
                                                                                            • SHA256 ea879a506149d8c0ed9082bc60b7f41b610924e178c74c442fe9c06a40b6766a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            6[1].png
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G2QQ8LWO\6[1].png
                                                                                            • Size 507B
                                                                                            • SHA256 e049bcd6db077472c3d6be66325fc35136e620b5b5d7e7d6e55a4d29182ae183
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            time[1].js
                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G2QQ8LWO\time[1].js
                                                                                            • Size 27B
                                                                                            • SHA256 387a7ce4dacff8efe17b574ac671d8a6248947a9ed8e4c01436a05ac9f74e0b6
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            723fc83a-a0bc-4f5b-b70f-83125ad364bf.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\723fc83a-a0bc-4f5b-b70f-83125ad364bf.tmp
                                                                                            • Size 1B
                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            770b0b13-4059-40d4-9a81-91fd18d5685c.tmp
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\770b0b13-4059-40d4-9a81-91fd18d5685c.tmp
                                                                                            • Size 10KB
                                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            QHComHelper.inf
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Cab9C27\QHComHelper.inf
                                                                                            • Size 235B
                                                                                            • SHA256 75cf96523bdae2e83d6695177301a8b44a6dbbfa924e77dac65c42ae218a6cf2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            boslps.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\boslps.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 edafa43689b1e0be1ddc2c9139b701c512576924bf7cabdd2f3d1165c23583a4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ldsajdklsajdlkjsalkda.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                            • Size 589B
                                                                                            • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            messages.json
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2300_2083043426\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                            • Size 711B
                                                                                            • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            content.js
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2300_632300489\CRX_INSTALL\content.js
                                                                                            • Size 9KB
                                                                                            • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            017105.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\017105.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 6a51f1d6271b44752a9acf3232458aa4b3d8562e1005d9ce08977304180b86ac
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            071750.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\071750.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 e4d91f5d060e9ed821d40d91f006a3c10d836997a7168d5d83b849c1a74f7405
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            206274.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\206274.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 097c4fbf472c146820030db1173cd6a1404b5c586972416ed9785456ac73fe49
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            283444.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\283444.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 51172b8bf77c4d34ac2c0d5e07c3603aa2373a2c14afd669340f970730be942b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            327830.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\327830.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 d2a9350fbddc043a89ed7a3ec7bde0ca4e0f18b2bdf91846d15f6d723b4436cd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            338159.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\338159.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 7f268b2a76e8872c8bcbcd9a803472a82f84b6bc3bc6fd05013e7c628d45d603
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            553813.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\553813.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 73ebace66c7ee03fc0d856dd5ea16a9fd524ecef592fe5cf708cfdb386d395e9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            555053.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\555053.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 220750302b56dfb02ca887542d37c8ff0880d26c9372c3b79d944e461571b59e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            566092.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\566092.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 f70e1a24d03533cfeb41aa11c847657a26417d490dffc09c592644b5e6f7c4fe
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            681036.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\681036.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 f7fe6ffa1dc522f9668bea7ebe6a510233be339c224f9f77fc72642079b47ece
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            684156.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\684156.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 6e94f15bf85cca6a3ce9b147ebdbfe4143f4ad89b1431a931ecf43051c3b9b8c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            866939.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\866939.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 784d4444fc243f13534163a87899b45d838eeb401becc365688a081616513370
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            888740.exe
                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\888740.exe
                                                                                            • Size 1.5MB
                                                                                            • SHA256 289ca78fc673a7a4204fb1cce9d4a9746915189542fcc451a46db48de5f7eb4e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1761696504\manifest.json
                                                                                            • Size 135B
                                                                                            • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            manifest.json
                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1838405326\manifest.json
                                                                                            • Size 43B
                                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            memory/3348-896-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-218-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-1230-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download

                                                                                            memory/4168-121-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                            Download