Analysis
- max time kernel
89s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 18:04
General
- Target 2026-10-01_261787c96158e89a8d2020498099c1ef_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261002-wnvn2athmf
- SHA256 b60d933b9c3ad9ba67f080d77383aa1b053232a2109d8f8136473af598c3e516
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 58 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 59 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 44 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_261787c96158e89a8d2020498099c1ef_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_261787c96158e89a8d2020498099c1ef_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\kkzouf.exe"C:\Users\Admin\AppData\Local\Temp\kkzouf.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kkzouf.exe"C:\Users\Admin\AppData\Local\Temp\kkzouf.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\531770.exe"C:\Users\Admin\AppData\Roaming\Download\531770.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\531770.exe"C:\Users\Admin\AppData\Roaming\Download\531770.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\786007.exe"C:\Users\Admin\AppData\Roaming\Download\786007.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\786007.exe"C:\Users\Admin\AppData\Roaming\Download\786007.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\159242.exe"C:\Users\Admin\AppData\Roaming\Download\159242.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\159242.exe"C:\Users\Admin\AppData\Roaming\Download\159242.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\787648.exe"C:\Users\Admin\AppData\Roaming\Download\787648.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\787648.exe"C:\Users\Admin\AppData\Roaming\Download\787648.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\063138.exe"C:\Users\Admin\AppData\Roaming\Download\063138.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\063138.exe"C:\Users\Admin\AppData\Roaming\Download\063138.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\320578.exe"C:\Users\Admin\AppData\Roaming\Download\320578.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\320578.exe"C:\Users\Admin\AppData\Roaming\Download\320578.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\376885.exe"C:\Users\Admin\AppData\Roaming\Download\376885.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\376885.exe"C:\Users\Admin\AppData\Roaming\Download\376885.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\539689.exe"C:\Users\Admin\AppData\Roaming\Download\539689.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\539689.exe"C:\Users\Admin\AppData\Roaming\Download\539689.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\402462.exe"C:\Users\Admin\AppData\Roaming\Download\402462.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\402462.exe"C:\Users\Admin\AppData\Roaming\Download\402462.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\761269.exe"C:\Users\Admin\AppData\Roaming\Download\761269.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\761269.exe"C:\Users\Admin\AppData\Roaming\Download\761269.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\507685.exe"C:\Users\Admin\AppData\Roaming\Download\507685.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\507685.exe"C:\Users\Admin\AppData\Roaming\Download\507685.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\000114.exe"C:\Users\Admin\AppData\Roaming\Download\000114.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\000114.exe"C:\Users\Admin\AppData\Roaming\Download\000114.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\357913.exe"C:\Users\Admin\AppData\Roaming\Download\357913.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\357913.exe"C:\Users\Admin\AppData\Roaming\Download\357913.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\838628.exe"C:\Users\Admin\AppData\Roaming\Download\838628.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\838628.exe"C:\Users\Admin\AppData\Roaming\Download\838628.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\942073.exe"C:\Users\Admin\AppData\Roaming\Download\942073.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\942073.exe"C:\Users\Admin\AppData\Roaming\Download\942073.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\333687.exe"C:\Users\Admin\AppData\Roaming\Download\333687.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\333687.exe"C:\Users\Admin\AppData\Roaming\Download\333687.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\930833.exe"C:\Users\Admin\AppData\Roaming\Download\930833.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\930833.exe"C:\Users\Admin\AppData\Roaming\Download\930833.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\430547.exe"C:\Users\Admin\AppData\Roaming\Download\430547.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\430547.exe"C:\Users\Admin\AppData\Roaming\Download\430547.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\136973.exe"C:\Users\Admin\AppData\Roaming\Download\136973.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\136973.exe"C:\Users\Admin\AppData\Roaming\Download\136973.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\508110.exe"C:\Users\Admin\AppData\Roaming\Download\508110.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\508110.exe"C:\Users\Admin\AppData\Roaming\Download\508110.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\161834.exe"C:\Users\Admin\AppData\Roaming\Download\161834.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\161834.exe"C:\Users\Admin\AppData\Roaming\Download\161834.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\837976.exe"C:\Users\Admin\AppData\Roaming\Download\837976.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\837976.exe"C:\Users\Admin\AppData\Roaming\Download\837976.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\574147.exe"C:\Users\Admin\AppData\Roaming\Download\574147.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\574147.exe"C:\Users\Admin\AppData\Roaming\Download\574147.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\484289.exe"C:\Users\Admin\AppData\Roaming\Download\484289.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\484289.exe"C:\Users\Admin\AppData\Roaming\Download\484289.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\251559.exe"C:\Users\Admin\AppData\Roaming\Download\251559.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\251559.exe"C:\Users\Admin\AppData\Roaming\Download\251559.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\961591.exe"C:\Users\Admin\AppData\Roaming\Download\961591.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\961591.exe"C:\Users\Admin\AppData\Roaming\Download\961591.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\808854.exe"C:\Users\Admin\AppData\Roaming\Download\808854.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\808854.exe"C:\Users\Admin\AppData\Roaming\Download\808854.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\778711.exe"C:\Users\Admin\AppData\Roaming\Download\778711.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\778711.exe"C:\Users\Admin\AppData\Roaming\Download\778711.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\520608.exe"C:\Users\Admin\AppData\Roaming\Download\520608.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\520608.exe"C:\Users\Admin\AppData\Roaming\Download\520608.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\221237.exe"C:\Users\Admin\AppData\Roaming\Download\221237.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\221237.exe"C:\Users\Admin\AppData\Roaming\Download\221237.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\725748.exe"C:\Users\Admin\AppData\Roaming\Download\725748.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\725748.exe"C:\Users\Admin\AppData\Roaming\Download\725748.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\871920.exe"C:\Users\Admin\AppData\Roaming\Download\871920.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\871920.exe"C:\Users\Admin\AppData\Roaming\Download\871920.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\130728.exe"C:\Users\Admin\AppData\Roaming\Download\130728.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\130728.exe"C:\Users\Admin\AppData\Roaming\Download\130728.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\804681.exe"C:\Users\Admin\AppData\Roaming\Download\804681.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\804681.exe"C:\Users\Admin\AppData\Roaming\Download\804681.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\295294.exe"C:\Users\Admin\AppData\Roaming\Download\295294.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\295294.exe"C:\Users\Admin\AppData\Roaming\Download\295294.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\389441.exe"C:\Users\Admin\AppData\Roaming\Download\389441.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\389441.exe"C:\Users\Admin\AppData\Roaming\Download\389441.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\144887.exe"C:\Users\Admin\AppData\Roaming\Download\144887.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\144887.exe"C:\Users\Admin\AppData\Roaming\Download\144887.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\548316.exe"C:\Users\Admin\AppData\Roaming\Download\548316.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\548316.exe"C:\Users\Admin\AppData\Roaming\Download\548316.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\632683.exe"C:\Users\Admin\AppData\Roaming\Download\632683.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\632683.exe"C:\Users\Admin\AppData\Roaming\Download\632683.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\476829.exe"C:\Users\Admin\AppData\Roaming\Download\476829.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\476829.exe"C:\Users\Admin\AppData\Roaming\Download\476829.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\725706.exe"C:\Users\Admin\AppData\Roaming\Download\725706.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\725706.exe"C:\Users\Admin\AppData\Roaming\Download\725706.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\128237.exe"C:\Users\Admin\AppData\Roaming\Download\128237.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\128237.exe"C:\Users\Admin\AppData\Roaming\Download\128237.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\175498.exe"C:\Users\Admin\AppData\Roaming\Download\175498.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\175498.exe"C:\Users\Admin\AppData\Roaming\Download\175498.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\945455.exe"C:\Users\Admin\AppData\Roaming\Download\945455.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\945455.exe"C:\Users\Admin\AppData\Roaming\Download\945455.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\307159.exe"C:\Users\Admin\AppData\Roaming\Download\307159.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\307159.exe"C:\Users\Admin\AppData\Roaming\Download\307159.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\143495.exe"C:\Users\Admin\AppData\Roaming\Download\143495.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\143495.exe"C:\Users\Admin\AppData\Roaming\Download\143495.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\505219.exe"C:\Users\Admin\AppData\Roaming\Download\505219.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\505219.exe"C:\Users\Admin\AppData\Roaming\Download\505219.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffd8136c188,0x7ffd8136c194,0x7ffd8136c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,371597052687035880,266305385218821809,262144 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,16235374223630784185,16813034051852760323,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,3182036569833661043,12139972373524835334,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17898141297284171773,8845429353135676720,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,11363614362283672487,1193916520849153637,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2028295441234946021,3388810261101389669,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,12671504300358500355,9065335824928541277,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,18021832038312021630,17243927397894110021,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5516,i,8271424279027776351,5288731473007148472,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,518891200756326177,17211403821630936308,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4862236330820621541,7736817225414712579,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15491888770416595389,12846703484751784797,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15491888770416595389,12846703484751784797,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,4862740036433756539,2824744431452190867,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,2312161109547362275,13329570359294409623,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6880,i,7769651987779734457,8636802089024206990,2097152 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,1201865879728728195,3224092878970051754,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,7998391218016306682,13241311246618604487,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,3286377924393721092,10082072923549761289,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,4139447502200872101,411249933376356958,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12206188176478897293,12366941204993343010,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,17886697609943507778,741356730564250189,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,18160570782613036356,16964558572521248025,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7051554449261474983,16490813565397166147,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,330008929883886619,12058615405562811621,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5228,i,6000086143812704492,14609901117352396718,262144 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6745782177604346265,3064979114254087527,524288 --field-trial-handle=2416,i,15704560821394998452,13058565059179923374,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
234dbd51-ba6d-48b4-891b-580cb0716626.tmp
6860f23e-27cc-4fbe-9572-f2bfd71931ba.tmp
9c5df3e0-8f1d-4b99-9e2a-cb75db5d7674.tmp
1f4ed417-288d-4a63-a04f-3c5b23a4034d.tmp
settings.dat
settings.dat
17ee0a70-9f8e-4d9f-b161-27416ff80981.tmp
25ccb505-6772-4451-9f31-f5ecf9e947cf.tmp
52670961-40aa-4bd7-b068-8de0610df7fc.tmp
96f9b4f9adf74a24_0
temp-index
temp-index
the-real-index
478eb20f-b422-4ce8-b51c-18030859e73d.tmp
476dd47a-5e6a-4dc9-ac30-8a573150c409.tmp
b0164c12-5edb-4f4a-9bad-26437d62a2a4.tmp
d0f580a9-c94e-4cb0-a48e-863c6af8a4c5.tmp
sync_diagnostic.log
c95dfdd4-24bc-4d04-888e-a9233311aa50.tmp
eae88ec7-ddbb-4ef2-bef9-e0756e1a6249.tmp
eec8785a-5d0f-4933-9568-5b4c1239e08b.tmp
278ab641-63ad-4826-ab0c-7066c80c73c8.tmp
00cf93c0-67e8-44cc-a0dc-5b81048990e5.tmp
3776cb7b-86fe-4621-ac69-5d7991732e9d.tmp
54ae5043-98db-4b65-a9ea-b8f6f809cdf6.tmp
3f630540-ea3f-4281-b54b-771d29bff4f5.tmp
f49f30d5-672c-4fd1-9069-e27e0b035ecb.tmp
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
time[1].js
113[1].js
sed_api_weather_info[1].htm
4985d674-f271-4a62-99af-cb4b7161fa74.tmp
a9214229-8b89-4e30-9f2c-17c1ec10ae95.tmp
kkzouf.exe
ldsajdklsajdlkjsalkda.bat
content.js
000114.exe
063138.exe
159242.exe
320578.exe
357913.exe
376885.exe
402462.exe
507685.exe
531770.exe
539689.exe
761269.exe
786007.exe
787648.exe
manifest.json
manifest.json
manifest.json
manifest.json
memory/5192-911-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-948-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1053-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-989-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1098-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-246-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1145-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-810-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1190-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-696-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1227-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-865-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1282-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1312-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5784-134-0x0000000000400000-0x000000000059A000-memory.dmp