aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ = "shdocvw.dll"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ThreadingModel = "Apartment"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SHServicePlatform\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\SHApp\\7.0.17.0\\shsp.dll"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MYLogger.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHPlayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9377mycs_Y_mgaz2_01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe

Loads dropped DLL 64 IoCs

pid	Process
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
4756	9377mycs_Y_mgaz2_01.exe
4756	9377mycs_Y_mgaz2_01.exe
4756	9377mycs_Y_mgaz2_01.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
4756	9377mycs_Y_mgaz2_01.exe
4756	9377mycs_Y_mgaz2_01.exe
4756	9377mycs_Y_mgaz2_01.exe
4756	9377mycs_Y_mgaz2_01.exe
4216	MYLogger.exe
2760	MYLogger.exe
1628	MYLogger.exe
5060	MYLogger.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
1932	regsvr32.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
4820	svchost.exe
2080	FileAssociationsTool.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SHPlayer = "\"C:\\Users\\Admin\\AppData\\Roaming\\????\\7.0.17.0\\SHPlayer.exe\" /auto"	FileAssociationsTool.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.ini	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\uninstall.exe	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\replay.htm	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7ce88343-934c-4a3c-af08-8723e6da54a8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221109012928.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000400000001e6d5-187.dat	nsis_installer_1
behavioral2/files/0x000400000001e6d5-187.dat	nsis_installer_2
behavioral2/files/0x000400000001e6d5-183.dat	nsis_installer_1
behavioral2/files/0x000400000001e6d5-183.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SHPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SHPlayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	MYLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	MYLogger.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	MYLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	MYLogger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	MYLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	MYLogger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	MYLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	MYLogger.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mpeg\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.rmvb\shell\open\command	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.rmvb\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\Skin\\Default\\icon\\rmvb.ico"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\ = "使用搜狐看图打开"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ts	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.heic	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4891BA68-4A0E-435D-9082-3ED9C5F66FCD}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fli	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.qt\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpg	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.arw\ = "图片文件(.arw)"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shplayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHPlayer.exe\" \"%1\""	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.rmvb	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\Instance\CLSID = "{0AFACED1-E828-11D1-9187-B532F1E9575D}"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.wmv\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.png\ = "SHImageViewer.png"	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.dng\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.jpeg\shell	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\Instance	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mkv\shell\open	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.gif\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7DDBA5B-45A9-4B01-AFBC-75EAB53ED66B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHIEPlugin.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.heic\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m4v\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ifox\DefaultIcon	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.difox\shell\open\command	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.svg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shplayer\shell	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tiff\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F06D7B1-F9F3-4D23-B02C-C64C2A9A1745}\ = "SHIEPlugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoHuVA.SoHuDector\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.m4v\ = "SHPlayer.bak"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.arw\ = "SHImageViewer.bak"	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.wmv\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ts\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.bmp\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.difox\shell\ = "open"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.difox\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.rmvb\Shell	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.dng\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.dng\shell\ = "open"	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.f4v\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ts	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mov\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tif\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.gif\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.17.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2p	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.nef\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.asf	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.psd\Shell\使用搜狐看图打开	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.webm\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ico\Shell\使用搜狐看图打开	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7DDBA5B-45A9-4B01-AFBC-75EAB53ED66B}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2v\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.webp\shell	SHImageViewer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
3372	msedge.exe
3372	msedge.exe
948	msedge.exe
948	msedge.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
5060	SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
2856	SHPlayer.exe
2856	SHPlayer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2856	SHPlayer.exe
2856	SHPlayer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2760	MYLogger.exe
2760	MYLogger.exe
4216	MYLogger.exe
4216	MYLogger.exe
2080	FileAssociationsTool.exe
4972	FileAssociationsTool.exe
4024	FileAssociationsTool.exe
2024	FileAssociationsTool.exe
1496	FileAssociationsTool.exe
4108	FileAssociationsTool.exe
3924	FileAssociationsTool.exe
1460	FileAssociationsTool.exe
2856	SHPlayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 948	5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe	87
PID 5028 wrote to memory of 948	5028	aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe	87
PID 948 wrote to memory of 3044	948	msedge.exe	88
PID 948 wrote to memory of 3044	948	msedge.exe	88
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 808	948	msedge.exe	92
PID 948 wrote to memory of 3372	948	msedge.exe	93
PID 948 wrote to memory of 3372	948	msedge.exe	93
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94
PID 948 wrote to memory of 4484	948	msedge.exe	94

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3068
- C:\Users\Admin\AppData\Local\Temp\aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe
  "C:\Users\Admin\AppData\Local\Temp\aa78c357081cb6e7f62979d88d6c9e57c4e0e522124001fb6d76ba1206159e59.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bangshijz.com/YWE3OGMzNTcwODFjYjZlN2Y2Mjk3OWQ4OGQ2YzllNTdjNGUwZTUyMjEyNDAwMWZiNmQ3NmJhMTIwNjE1OWU1OS5leGU=/40.html
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf05d46f8,0x7ffcf05d4708,0x7ffcf05d4718
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6172 /prefetch:8
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1304 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1304 /prefetch:8
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff686c05460,0x7ff686c05470,0x7ff686c05480
        5⤵
        
        PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,18077657215213488009,6698849868612517942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:8
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\nsoABF5.tmp\9377mycs_Y_mgaz2_01.exe
    9377mycs_Y_mgaz2_01.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:4756
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
        
        "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" "1"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5060
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" 2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2760
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" 1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1628
- - C:\Users\Admin\AppData\Local\Temp\nsoABF5.tmp\SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
    SoHuVA_4.2.0.16-c204900009-ng-s-run-x.exe
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Sets DLL path for service in the registry
    - Checks computer location settings
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHBHO.dll"
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHIEPlugin.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1932
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\syspin.exe
      C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\syspin.exe "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHPlayer.exe" c:5386
      4⤵
      Executes dropped EXE
      PID:1808
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /EnableAutoRun
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2080
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /ModifyMainShortcut
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4972
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /F
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /TSet
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2024
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHImageViewer.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHImageViewer.exe" /AddAssoc
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:4500
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /ReleaseSWF
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4108
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /InstallSuccess 0
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3924
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:1460
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHPlayer.exe
      C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHPlayer.exe /InstallStart
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=2456 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:3852
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=3500 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:5180
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=utility --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=3460 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:5168
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=3880 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:5316
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=3916 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5336
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=3600 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:5452
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=4108 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:5496
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --mojo-platform-channel-handle=4760 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5564
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --mojo-platform-channel-handle=5304 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5660
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5348 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5676
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5372 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5692
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe
        
        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.17.0\SHCefEngine.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2460,530938918711443407,1225880253571541202,131072 --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=audio --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.17.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-09\01-29-33.log" --mojo-platform-channel-handle=5632 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2d4
1⤵
PID:6108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery