Overview

overview

8

Static

static

3

[电脑版...23.exe

windows10-2004-x64

7

[电脑版...23.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    300s
  • max time network
    315s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    [电脑版]SCNETx26.05.23.exe
  • Size 25.7MB
  • Sample260622-wwtrpse18k
  • SHA256 c582db37326d9c9ce980bf0559972d29bc045a67736375bac8ec2cb155e8a234
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 24 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\[电脑版]SCNETx26.05.23.exe
    "C:\Users\Admin\AppData\Local\Temp\[电脑版]SCNETx26.05.23.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\is-4S9SHNUX8H.tmp\[电脑版]SCNETx26.05.23.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4S9SHNUX8H.tmp\[电脑版]SCNETx26.05.23.tmp" /SL5="$502BC,25728283,893440,C:\Users\Admin\AppData\Local\Temp\[电脑版]SCNETx26.05.23.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Program Files (x86)\SurvivalcraftNet2.4\Survivalcraft.exe
        "C:\Program Files (x86)\SurvivalcraftNet2.4\Survivalcraft.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
          4⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffd6790c188,0x7ffd6790c194,0x7ffd6790c1a0
            5⤵
              PID:4828
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1928,i,17429408158352306152,10646072094839638371,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
              5⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:2240
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6075669294409132908,10827591951616849959,262144 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
              5⤵
                PID:3368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2496,i,8483494271151217572,966145156705190727,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
                5⤵
                  PID:4520
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,8096065763692303564,13867991917852292792,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                  5⤵
                    PID:1952
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,14436293791653126292,7039927908207884464,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
                    5⤵
                      PID:2464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15354124102791228622,6309642403305290890,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
                      5⤵
                        PID:3548
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,2324081899058793842,11319877297437325727,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
                        5⤵
                          PID:1604
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3804,i,16665609376443147199,3187469162490872777,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
                          5⤵
                            PID:3848
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3756,i,17264985503072124467,2060939723535537563,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
                            5⤵
                              PID:3092
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3540,i,13461218928523841336,10617052816941925699,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
                              5⤵
                                PID:1144
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5144,i,18240212237241962415,16437032283849557096,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                5⤵
                                  PID:2636
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5808,i,14888458725102170579,7495673530465442533,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
                                  5⤵
                                    PID:5448
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5808,i,14888458725102170579,7495673530465442533,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
                                    5⤵
                                      PID:1232
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6328,i,13034976698378312200,6570867906602080443,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
                                      5⤵
                                        PID:204
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6780,i,10660919191426610558,11083436239288002198,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
                                        5⤵
                                          PID:2568
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3812,i,17733385070368199855,5471008221774988506,2097152 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
                                          5⤵
                                            PID:3408
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5092,i,12854026949028074595,589030706978723150,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
                                            5⤵
                                              PID:5940
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6948,i,4160554793937867736,1812631834378384087,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
                                              5⤵
                                                PID:1628
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6992,i,13941626979129238534,17214445289036376366,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
                                                5⤵
                                                  PID:3264
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6960,i,4639779463352804186,4389425514782095641,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
                                                  5⤵
                                                    PID:1592
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=920,i,16201930306124303852,1917121570411065073,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:14
                                                    5⤵
                                                      PID:2996
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5432,i,8585664867042931716,4136156870264734803,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:14
                                                      5⤵
                                                        PID:4344
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2204,i,4776229644259351057,9339926733873746301,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
                                                        5⤵
                                                          PID:3756
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3824,i,17625717284359444737,9962302387124013024,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
                                                          5⤵
                                                            PID:1392
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6252,i,10771696467745363668,830828906568655650,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
                                                            5⤵
                                                              PID:6044
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,9710740311614590690,4065242383450146292,262144 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:10
                                                              5⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1124
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5872,i,1335821733043984149,3294136861820767636,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
                                                              5⤵
                                                                PID:4904
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5864,i,7101412795232307518,3788228828289633546,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
                                                                5⤵
                                                                  PID:3624
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6420,i,4613010977586107099,12870512996642958001,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                                  5⤵
                                                                    PID:1908
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3680,i,3726053788330272629,16844965048812961278,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                                                    5⤵
                                                                      PID:3732
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5028,i,4676698960878345990,7901510733634516992,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
                                                                      5⤵
                                                                        PID:6080
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6760,i,4947373128436546672,7103927864751693547,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
                                                                        5⤵
                                                                          PID:1388
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3688,i,13929921695678078596,552128487747537375,524288 --field-trial-handle=2384,i,11040930858755980570,12161329825843049932,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
                                                                          5⤵
                                                                            PID:2888
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:3752
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                      1⤵
                                                                        PID:5776
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                        1⤵
                                                                          PID:4292

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              Survivalcraft.exe
                                                                              • Path C:\Program Files (x86)\SurvivalcraftNet2.4\Survivalcraft.exe
                                                                              • Size 219KB
                                                                              • SHA256 731b559c98ff871695290b71cb0794b5f18c4e6fb5f196e388db98a2d2c30c4b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Survivalcraft.runtimeconfig.json
                                                                              • Path C:\Program Files (x86)\SurvivalcraftNet2.4\Survivalcraft.runtimeconfig.json
                                                                              • Size 340B
                                                                              • SHA256 3c0bf772b95c93363a0a14e5df78e4ec408c90f04cb7103205af97b2d276fab0
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 00fbb63799d26e9a7e30ff53840386023c5150d62b9ea487041ad388db361544
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              settings.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                              • Size 280B
                                                                              • SHA256 cffda89706c34029bbadb3a079f8166927ce29a27926faf81be0941753fa411c
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              BookmarkMergedSurfaceOrdering
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                              • Size 6B
                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                              • Size 3KB
                                                                              • SHA256 582894892f66d406d521bc6a7d43513abcb6e58a8f9668f428237bcd515c1db6
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              SiteList-Enterprise.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                              • Size 2B
                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Edge Profile.ico
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                              • Size 70KB
                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                              • Size 2KB
                                                                              • SHA256 4d1c45234f2372b005ed503769583a0e12dbdee45ff9bb058997c61755a8f30d
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              SCT Auditing Pending Reports
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                              • Size 2B
                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Sdch Dictionaries
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                              • Size 40B
                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 14KB
                                                                              • SHA256 fc2e35f261da5a70d53086d3dbb081e4fc63518a42d8d176f0ac3261f0219c3e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 14KB
                                                                              • SHA256 adef2338080f76e8f713192ee72d1165e525665a55dbc92d1461476fccd6315e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 15KB
                                                                              • SHA256 ac20feba272fb85cd9baee158d9d68387be6daf0f3890a7e41dad35c5240eeac
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                              • Size 14KB
                                                                              • SHA256 ffe90f0a1ab35c64edb857700cdc17e3479fc0461cc499283d690e1cea27c6a1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Secure Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                              • Size 32KB
                                                                              • SHA256 92aec8591fb1e4853d30335c294a244fd9aa5d4c7b7c06833da04818f7b1490b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              sync_diagnostic.log
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                              • Size 4KB
                                                                              • SHA256 2e69d838f14fade934f85bd91b27fa784aadae989cb6e81b0374dbbffeb24253
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              f5ce3d58-db5f-40ed-9eae-32463dc2a03d.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f5ce3d58-db5f-40ed-9eae-32463dc2a03d.tmp
                                                                              • Size 22KB
                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 38KB
                                                                              • SHA256 5cf582847eabd3583841093904f39e84c6bbb8da9afb8100cb992dde4189e2b3
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 35KB
                                                                              • SHA256 411f1d6acbb49cbdbdfbb97cbd1b4b57355db8c5549d488df382dd26202b13ab
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 35KB
                                                                              • SHA256 57d76c73736469bbed62833c686c8435981d997fc92be9f7ff0faadcd2b654ac
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                              • Size 43KB
                                                                              • SHA256 e7f38eadf042c748396ff81c4d4fc112cb85334b7d5dfe76809b533dcaa47277
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 252B
                                                                              • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 492B
                                                                              • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 132B
                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 732B
                                                                              • SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 372B
                                                                              • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 612B
                                                                              • SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              metadata.json
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                              • Size 852B
                                                                              • SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              0068526f-0d2c-45aa-8c8c-4cac3cc2b55e.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0068526f-0d2c-45aa-8c8c-4cac3cc2b55e.tmp
                                                                              • Size 13B
                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              [电脑版]SCNETx26.05.23.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-4S9SHNUX8H.tmp\[电脑版]SCNETx26.05.23.tmp
                                                                              • Size 4.2MB
                                                                              • SHA256 728372b37da5950ebbb5e7aee93cd89375a39ff2e75d2a2a39c8b7c1f707d2a0
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              content_new.js
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4992_1915460820\CRX_INSTALL\content_new.js
                                                                              • Size 10KB
                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              SurvivalcraftNet2.4.lnk
                                                                              • Path C:\Users\Public\Desktop\SurvivalcraftNet2.4.lnk
                                                                              • Size 1KB
                                                                              • SHA256 800e2b50835318d2ccc65d1ca06af6d8a204f266ec0f77da5f3b71800a9eaf11
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              LICENSE
                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_94718390\LICENSE
                                                                              • Size 1KB
                                                                              • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              memory/1420-8-0x00000000006E0000-0x00000000007C9000-memory.dmp
                                                                              Download

                                                                              memory/1420-0-0x00000000006E0000-0x00000000007C9000-memory.dmp
                                                                              Download

                                                                              memory/1420-137-0x00000000006E0000-0x00000000007C9000-memory.dmp
                                                                              Download

                                                                              memory/5028-14-0x0000000000400000-0x000000000084B000-memory.dmp
                                                                              Download

                                                                              memory/5028-6-0x00000000013B0000-0x00000000013B1000-memory.dmp
                                                                              Download

                                                                              memory/5028-130-0x0000000000400000-0x000000000084B000-memory.dmp
                                                                              Download

                                                                              memory/5028-12-0x0000000000400000-0x000000000084B000-memory.dmp
                                                                              Download

                                                                              memory/5028-136-0x0000000000400000-0x000000000084B000-memory.dmp
                                                                              Download

                                                                              memory/5028-10-0x00000000013B0000-0x00000000013B1000-memory.dmp
                                                                              Download

                                                                              memory/5028-9-0x0000000000400000-0x000000000084B000-memory.dmp
                                                                              Download