e459f8cb2f7f0a447c0a4ddb2adbb00b4da7c2f52190701154913d57214993fa

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kbly/guanwang/guanwang.exe
Size 970KB
Sample260818-nwry4sam2v
SHA256 e459f8cb2f7f0a447c0a4ddb2adbb00b4da7c2f52190701154913d57214993fa
MD5 910211f7641b79b437336ee777390c43
SHA1 11932b013dff096bc74016cd9f17d9a687c8ccda
SHA512 8ff622fd6bf30f3ac588c92a52aff5bad6e3710a6efb2dc3c333f6e6a37aa044aa8c156a365923dfe502274c1c56f1950851e74a0529b9b4f524c0d89795dde9
SSDEEP 24576:sZbGGqzI6RzGV7jD8mNnamDw8SDLs48bco8y6:sZbGGKVRzGRjJMswnvf8bLs
TLSH
T1002523B4865A9838EFB26A3051DD527F1F55E00C57B0DB0CCA361A8EDCA6B427F52336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery upx

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral17/memory/2596-0-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx
behavioral17/memory/2596-155-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx
behavioral17/memory/2596-177-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx
behavioral17/memory/2596-187-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx
behavioral17/memory/2596-226-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx
behavioral17/memory/2596-237-0x0000000000EE0000-0x000000000119A000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_792158827\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_403971453\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_403971453\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1474733472\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_792158827\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_403971453\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1474733472\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1474733472\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_792158827\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guanwang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	msedgewebview2.exe
3692	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4784	msedgewebview2.exe
4784	msedgewebview2.exe
4784	msedgewebview2.exe
4784	msedgewebview2.exe
4784	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	guanwang.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2596	guanwang.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4796	2596	guanwang.exe	90
PID 4796 wrote to memory of 4784	4796	webview2.exe	91
PID 4784 wrote to memory of 6120	4784	msedgewebview2.exe	92
PID 4784 wrote to memory of 5436	4784	msedgewebview2.exe	93
PID 4784 wrote to memory of 5436	4784	msedgewebview2.exe	93
PID 4784 wrote to memory of 5436	4784	msedgewebview2.exe	93
PID 4784 wrote to memory of 5436	4784	msedgewebview2.exe	93
PID 4784 wrote to memory of 6248	4784	msedgewebview2.exe	94
PID 4784 wrote to memory of 3948	4784	msedgewebview2.exe	95
PID 4784 wrote to memory of 3948	4784	msedgewebview2.exe	95
PID 4784 wrote to memory of 3948	4784	msedgewebview2.exe	95
PID 4784 wrote to memory of 2792	4784	msedgewebview2.exe	96
PID 4784 wrote to memory of 2792	4784	msedgewebview2.exe	96
PID 4784 wrote to memory of 2792	4784	msedgewebview2.exe	96
PID 4784 wrote to memory of 2792	4784	msedgewebview2.exe	96
PID 4784 wrote to memory of 2792	4784	msedgewebview2.exe	96
PID 4784 wrote to memory of 2824	4784	msedgewebview2.exe	98
PID 4784 wrote to memory of 2824	4784	msedgewebview2.exe	98
PID 4784 wrote to memory of 2824	4784	msedgewebview2.exe	98
PID 4784 wrote to memory of 2824	4784	msedgewebview2.exe	98
PID 4784 wrote to memory of 2824	4784	msedgewebview2.exe	98
PID 4784 wrote to memory of 4084	4784	msedgewebview2.exe	99
PID 4784 wrote to memory of 4084	4784	msedgewebview2.exe	99
PID 4784 wrote to memory of 4084	4784	msedgewebview2.exe	99
PID 4784 wrote to memory of 4084	4784	msedgewebview2.exe	99
PID 4784 wrote to memory of 4084	4784	msedgewebview2.exe	99
PID 4784 wrote to memory of 6200	4784	msedgewebview2.exe	101
PID 4784 wrote to memory of 6200	4784	msedgewebview2.exe	101
PID 4784 wrote to memory of 6200	4784	msedgewebview2.exe	101
PID 4784 wrote to memory of 6200	4784	msedgewebview2.exe	101
PID 4784 wrote to memory of 6200	4784	msedgewebview2.exe	101
PID 4784 wrote to memory of 6432	4784	msedgewebview2.exe	103
PID 4784 wrote to memory of 6432	4784	msedgewebview2.exe	103
PID 4784 wrote to memory of 6432	4784	msedgewebview2.exe	103
PID 4784 wrote to memory of 5820	4784	msedgewebview2.exe	104
PID 4784 wrote to memory of 5820	4784	msedgewebview2.exe	104
PID 4784 wrote to memory of 5820	4784	msedgewebview2.exe	104
PID 4784 wrote to memory of 2132	4784	msedgewebview2.exe	105
PID 4784 wrote to memory of 2132	4784	msedgewebview2.exe	105
PID 4784 wrote to memory of 2132	4784	msedgewebview2.exe	105
PID 4784 wrote to memory of 2132	4784	msedgewebview2.exe	105
PID 4784 wrote to memory of 2132	4784	msedgewebview2.exe	105
PID 4784 wrote to memory of 3692	4784	msedgewebview2.exe	106
PID 4784 wrote to memory of 1976	4784	msedgewebview2.exe	107
PID 4784 wrote to memory of 1976	4784	msedgewebview2.exe	107
PID 4784 wrote to memory of 1976	4784	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\kbly\guanwang\guanwang.exe
"C:\Users\Admin\AppData\Local\Temp\kbly\guanwang\guanwang.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\kbly\Utils\webview2.exe
  "C:\Users\Admin\AppData\Local\Temp\kbly\Utils\webview2.exe" --parent_wnd=40210 --tab_rect="0,0,0,0" --tab_ids="278D67D1-44F5-4640-90E6-4B92404A55D7" --cmd="" --url="https://dsyx.com/micro/sbqj/index_v1.html?channel=guanwang&timestamp=1787053525&from=guanwang__microgame&mid=e01ceb0f19097ef8ebfbc4504b862d5e&open_type=self&scene=&app=microgame&appver=65535.1026.1010.603&modver=65535.1026.1010.603&mid2=1feec8117a3e445aadf7724b05430928390dd2142b78&sr=no_scan&channel2=&pushtype=&osbuild=26100&version=65535.1026.1010.603&lastRunTime=&timestamp=1787053525" --tab_group_ids="9D5C0F46-A227-4dc7-A961-474DB41B02F1" --web_view_id=256 --allow-universal-access-from-files --cache_path="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache" --log_file="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\cef.log" --disable_keyboard_filter
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --cache_path="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache" --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --lang=zh-cn --accept-lang=zh-cn --mojo-named-platform-channel-pipe=4796.2248.17674558458676148087 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView /prefetch:4 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x180,0x194,0x7ffb85ff5fd8,0x7ffb85ff5fe4,0x7ffb85ff5ff0
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:2 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:3 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=zh-CN --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2360 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4116 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4752 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4308 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4304 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3 /prefetch:1
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4016 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView" --webview-exe-name=webview2.exe --webview-exe-version=1.0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=1732,i,8751734604851027686,13101082179416600062,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:794aa48a297243df323ca08abc23c20dc70358b3
      4⤵
      PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6a78c34d2d046afb1a03b1a622ad0d1058bcf926cc0610e037dec0454aed672a
MD5 4ad6dae621e844f7b1d36094e3d939a2
SHA1 5b193e81a4f8b7e740d9a538203ed7eb323aa033
SHA512 61b431025353871bfd343b2a83ebe4654b52a5a54b437b61f35008fbbdcefc5f14d59a1f53553f470c1997adc4a9af4c3305e8a1f1f4f5f57393bf77c8679a74
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 089938294af6b06f7f87ddd195b88fcd116ab2dd73524f308d6893ae1df09d24
MD5 b73135bbc4daa7a6ee5e649c32ff6144
SHA1 c4d0d0491cae90757d0f9b442c0879b45ec7b4ce
SHA512 99314e390686b2a7e97c36be06898f2b097f32e0dfced867d124db19e897a621d10e7eec972dba55038d65ce8f60e85be303312cddde8f2409ae2651e5476b5d
TLSH
T13CD01123B3020238C02028332802BA082A00C20B820A8000A83E8A2E2A088A02A0B883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af8f8.TMP

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Network\Network Persistent State~RFe5af8f8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 2675c174e006cb0eb8ba2e25224cc6deae90c011d0a0586a6655b436a31e9fb8
MD5 c2637ac2f7cb646d69e07cceaf51fbfc
SHA1 fc5f5297331061e37b1d11e0297e1f45098e6c53
SHA512 4c665a7bf34eb9812ffe97e23129154debb7f559c5e6493a93443439807ef201e5bedde5308a2d988ba6fc4dee29a2a7dc8fa1cf22709a97813d1f2fead0ea98
TLSH
T1C2C02262402DA07A20B80A264A80ED05AF3FE030014198E89A42C73DD010477E203043
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a52c5.TMP

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Network\TransportSecurity~RFe5a52c5.TMP
Size 188B
SHA256 1ee529a3845eb41c35c00727ae80c18bdd1d6c2e21bd3fafcda4f3112a4c7b96
MD5 55e24438f77b81e9acea914dea83de0d
SHA1 81add0436cd310ed20c009a63b8a4939bca2ff14
SHA512 776d7773b2241d1518f43442d65016f6d37ba3eb9ab13183fa3abdfd92fed40ccb7f55d1607dd0aaf289dce72ad44fa038453469636819a98d329fc7cdfc871a
TLSH
T1ACC0C062C03DE03660780B665A80FD85BF3EF2321141D8ECDA5386BD90141778203003
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Preferences
Size 5KB
SHA256 d020148586f97f46b650ae1e2d8d1a379efb73261af2f3ac1d1651ae063984c1
MD5 9152f844c93e63771f3fa8da26d496fa
SHA1 5d2b97f08f5918bac5608d18489e777cc3dec11a
SHA512 a0a272044a68cb5ee94a6b171b29f901b509e94a5a287ca643e113fb950000f9e33bbd086d6bb71ebd940abf23011a16aa4512580870a8c915b913be0a155bff
SSDEEP 96:st1/dCtGEb9Jk9xx5h16Zo7As7/x+6MhmuecmjeC5K+gd28XMjC7K:stpcixxLUsV+Fij+XG8K
TLSH
T181C1A7025F24797B4CC7F619BA297A13D3F9A17234D51E58EBF8861C08DA5CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Preferences
Size 5KB
SHA256 584d37bf06c329220e47cf51956b9cb66fed5b13245a94661ecc52d66393ae4c
MD5 84a8f017d5d1c91382a70078905dc7b3
SHA1 2a92362388f585d4be6f0a7fc1959e5b62d84233
SHA512 32a1a88393ac60d296dc2d2ca70ed9dde14c5b8e8caa0a824968ab2eb18fe34dd8b4049eb24e1203103fa73cc8dbe2bc614d52f76ee1cf9df8056b7bc8b13da9
SSDEEP 96:st1/dCt9GEb9Jk9xx5h16Zo7As7/x+6MhmuecmjeC5K+gf28XMjC7K:stpOixxLUsV+Fij+1G8K
TLSH
T13AC1A6025F24797B4CC7F619BA297A13D3F9A07264E51E58EBF8861C08DA9DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a4e7f.TMP

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Preferences~RFe5a4e7f.TMP
Size 5KB
SHA256 838c2e1e58c5aecb05df5e9e4763ece6fd57df044c488e869a554fcb6b74a4d9
MD5 711ef1d61a633760acc0f39b702be2dd
SHA1 632c127899d152842d9e1477f7eae52184ebad90
SHA512 f158d8eaea38e5d935c2859f65b979ae067dcb8aad520b7dc624877915f193c72596649606e2c063abc90c067b66e1c5ff83b0a3401d70db2ac94ed7362009ee
SSDEEP 96:r1/ditGEb9Jkhdxx616ZZs7/x+6MhmuecmjeC5K+gJ28XMjC7K:rp8ixxjsV+Fij+3G8K
TLSH
T102B196065F28B97B0CC6F608FA297A13D3F9E16134D51D58EBF8862C08DA9DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Local State
Size 2KB
SHA256 15e2315bc0bee14ba6bddb1b00b958181e3be058103685e833a38af436cd3927
MD5 8dc8241c7ec2019aa6dc5c19e4fc99d5
SHA1 538861e7d5f037742864991d988afdc60d84c89e
SHA512 45dbbfe303541c6a4fcb6df80a759bf99bad13e1044ec46507cc7b573eb99a4c411be06085199eb3d5a247dcab8c0c52b2d49a384133f55913e13bdab947ff98
TLSH
T1D6517433AC24AB3788F29B05BA4B3A27CB35D1A1DA631F159ADC0B1C01CA55C5315C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Local State
Size 3KB
SHA256 181e2fcbad61ffbe84f0f283d66b9e1e7508b2443954af299900d155628af4e3
MD5 09b5678a11062264447b13a63959e327
SHA1 ae052435481d78861852823ab0575a179dac0995
SHA512 b76760320aff860e2889f5591a6f6396ce41cb85d98ce8430d57e9c60b69c3c0c2ea4b9c2c962699898adb2eca47895b01eb3380d5a4e4959f3afbae7fb81943
TLSH
T16A6163379934AA3B8DF2DB05B9862B16A7A59163E5923F59DAEC0F0D01CB2881351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Local State
Size 3KB
SHA256 25dfeccc2f4de70baece30be7573f572cde549c6344ccdacbe9794739ab93347
MD5 bbc0fa4edaedc749f9a8b8fdb7c60789
SHA1 1e30ba164727ffa9f7bc2df044a8f3ae45b17e1c
SHA512 1866cbb0e82c71aa91f86324f08eb5573e6b374b2b054507488242ad41192d9fb2d64bed1f3ec2b5d7ec8db2dfad28c7eb8918bcdb02513502663b4c2d9ceeba
TLSH
T1FA7196279934AA374DF2DB05B94A3B17A775D123D9963F99DAEC0F0D01CB2890351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Local State
Size 15KB
SHA256 81bc5c96659004b69a352044f54cc20213f0acb50ee1806f3350503fa75617d6
MD5 02701d88713fd8d7b0b7b4cb7bc6a6dc
SHA1 769f6c28128d27254e674a07287e1c4340186d73
SHA512 33d4f69ccbc653e3ebfd81dd3a882b5f10d79102e660889e56fbfb93db5defe3a4f90e3b68188a9cd61c25621dc1fbe96ef32185f63e7490181b66be9bf58958
SSDEEP 384:O+aQikB+z/xvxjg/qhEO3NBSDuIt7M4EdywuE3:Z/UxvxjgC+OmBMD
TLSH
T17F728E2B58797E3795F7E605BA5D074BCBF8D4B290C26EB94EB85F0E06872880306D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59d095.TMP

Path C:\Users\Admin\AppData\Local\Temp\kbly\webview_cache\EBWebView\Local State~RFe59d095.TMP
Size 1KB
SHA256 b4c288b71f3384229b1761d36f7a6fc79d16f35d7bd7368e7f4d74f9234a6c27
MD5 96ec1780079e56c1ed1200a5bd994444
SHA1 5c88a40d62c43d5f90db612036bf6c1a1e39d917
SHA512 6430287f55037e9083ae8292da11d2bb5028b404b50c32b943635914c1c90f27c43eb188b0b73d8e1178399a23dceacc69223ce5d7d29892db11d3ee92a64efd
TLSH
T175213573C8256B33DCD1A74276577A1B5F31D0A6C2538E0466ED4B1D01CA48DE639837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2132-324-0x0000026C5E6B0000-0x0000026C5E759000-memory.dmp

Download

memory/2596-187-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2596-237-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2596-0-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2596-177-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2596-1-0x0000000001199000-0x000000000119A000-memory.dmp

Download

memory/2596-155-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2596-226-0x0000000000EE0000-0x000000000119A000-memory.dmp

Download

memory/2792-118-0x00007FFBA7F10000-0x00007FFBA7F11000-memory.dmp

Download

memory/2792-170-0x0000024782DF0000-0x0000024782E99000-memory.dmp

Download

memory/2824-231-0x000002011E620000-0x000002011E6C9000-memory.dmp

Download

memory/2824-211-0x000002011E620000-0x000002011E6C9000-memory.dmp

Download

memory/2824-325-0x000002011E620000-0x000002011E6C9000-memory.dmp

Download

memory/3692-345-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-341-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-344-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-346-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-342-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-343-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-337-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/3692-335-0x000002E3A9980000-0x000002E3A9981000-memory.dmp

Download

memory/4084-220-0x000002E6C75A0000-0x000002E6C7649000-memory.dmp

Download

memory/5436-25-0x00007FFBA7F10000-0x00007FFBA7F11000-memory.dmp

Download

memory/5436-194-0x0000021F074E0000-0x0000021F07589000-memory.dmp

Download

memory/5436-169-0x0000021F074E0000-0x0000021F07589000-memory.dmp

Download

memory/6200-234-0x000001EE569F0000-0x000001EE56A99000-memory.dmp

Download

memory/6432-261-0x00007FFBA80B0000-0x00007FFBA80B1000-memory.dmp

Download

memory/6432-260-0x00007FFBA6970000-0x00007FFBA6971000-memory.dmp

Download