Analysis
- max time kernel
145s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 21:49
General
- Target 2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261020-1psnaaav2n
- SHA256 28355fe3f72aa88cb3c1f80e9c79af53a0956f6afa4bc8aa12c52f997958d525
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 44 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\roukpw.exe"C:\Users\Admin\AppData\Local\Temp\roukpw.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\roukpw.exe"C:\Users\Admin\AppData\Local\Temp\roukpw.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\760404.exe"C:\Users\Admin\AppData\Roaming\Download\760404.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\760404.exe"C:\Users\Admin\AppData\Roaming\Download\760404.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\654914.exe"C:\Users\Admin\AppData\Roaming\Download\654914.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\654914.exe"C:\Users\Admin\AppData\Roaming\Download\654914.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\558976.exe"C:\Users\Admin\AppData\Roaming\Download\558976.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\558976.exe"C:\Users\Admin\AppData\Roaming\Download\558976.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\138347.exe"C:\Users\Admin\AppData\Roaming\Download\138347.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\138347.exe"C:\Users\Admin\AppData\Roaming\Download\138347.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\522779.exe"C:\Users\Admin\AppData\Roaming\Download\522779.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\522779.exe"C:\Users\Admin\AppData\Roaming\Download\522779.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\880700.exe"C:\Users\Admin\AppData\Roaming\Download\880700.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\880700.exe"C:\Users\Admin\AppData\Roaming\Download\880700.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\722110.exe"C:\Users\Admin\AppData\Roaming\Download\722110.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\722110.exe"C:\Users\Admin\AppData\Roaming\Download\722110.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\224741.exe"C:\Users\Admin\AppData\Roaming\Download\224741.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\224741.exe"C:\Users\Admin\AppData\Roaming\Download\224741.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\753548.exe"C:\Users\Admin\AppData\Roaming\Download\753548.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\753548.exe"C:\Users\Admin\AppData\Roaming\Download\753548.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\422881.exe"C:\Users\Admin\AppData\Roaming\Download\422881.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\422881.exe"C:\Users\Admin\AppData\Roaming\Download\422881.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\710495.exe"C:\Users\Admin\AppData\Roaming\Download\710495.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\710495.exe"C:\Users\Admin\AppData\Roaming\Download\710495.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\259392.exe"C:\Users\Admin\AppData\Roaming\Download\259392.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\259392.exe"C:\Users\Admin\AppData\Roaming\Download\259392.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\640906.exe"C:\Users\Admin\AppData\Roaming\Download\640906.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\640906.exe"C:\Users\Admin\AppData\Roaming\Download\640906.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\030620.exe"C:\Users\Admin\AppData\Roaming\Download\030620.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\030620.exe"C:\Users\Admin\AppData\Roaming\Download\030620.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\045866.exe"C:\Users\Admin\AppData\Roaming\Download\045866.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\045866.exe"C:\Users\Admin\AppData\Roaming\Download\045866.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\645480.exe"C:\Users\Admin\AppData\Roaming\Download\645480.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\645480.exe"C:\Users\Admin\AppData\Roaming\Download\645480.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\149011.exe"C:\Users\Admin\AppData\Roaming\Download\149011.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\149011.exe"C:\Users\Admin\AppData\Roaming\Download\149011.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\314009.exe"C:\Users\Admin\AppData\Roaming\Download\314009.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\314009.exe"C:\Users\Admin\AppData\Roaming\Download\314009.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\611174.exe"C:\Users\Admin\AppData\Roaming\Download\611174.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\611174.exe"C:\Users\Admin\AppData\Roaming\Download\611174.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\766137.exe"C:\Users\Admin\AppData\Roaming\Download\766137.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\766137.exe"C:\Users\Admin\AppData\Roaming\Download\766137.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\145741.exe"C:\Users\Admin\AppData\Roaming\Download\145741.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\145741.exe"C:\Users\Admin\AppData\Roaming\Download\145741.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\491923.exe"C:\Users\Admin\AppData\Roaming\Download\491923.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\491923.exe"C:\Users\Admin\AppData\Roaming\Download\491923.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\026367.exe"C:\Users\Admin\AppData\Roaming\Download\026367.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\026367.exe"C:\Users\Admin\AppData\Roaming\Download\026367.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\272250.exe"C:\Users\Admin\AppData\Roaming\Download\272250.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\272250.exe"C:\Users\Admin\AppData\Roaming\Download\272250.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\875881.exe"C:\Users\Admin\AppData\Roaming\Download\875881.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\875881.exe"C:\Users\Admin\AppData\Roaming\Download\875881.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\581006.exe"C:\Users\Admin\AppData\Roaming\Download\581006.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\581006.exe"C:\Users\Admin\AppData\Roaming\Download\581006.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\402060.exe"C:\Users\Admin\AppData\Roaming\Download\402060.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\402060.exe"C:\Users\Admin\AppData\Roaming\Download\402060.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\093773.exe"C:\Users\Admin\AppData\Roaming\Download\093773.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\093773.exe"C:\Users\Admin\AppData\Roaming\Download\093773.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\242652.exe"C:\Users\Admin\AppData\Roaming\Download\242652.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\242652.exe"C:\Users\Admin\AppData\Roaming\Download\242652.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\643266.exe"C:\Users\Admin\AppData\Roaming\Download\643266.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\643266.exe"C:\Users\Admin\AppData\Roaming\Download\643266.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\978256.exe"C:\Users\Admin\AppData\Roaming\Download\978256.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\978256.exe"C:\Users\Admin\AppData\Roaming\Download\978256.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\367161.exe"C:\Users\Admin\AppData\Roaming\Download\367161.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\367161.exe"C:\Users\Admin\AppData\Roaming\Download\367161.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\513043.exe"C:\Users\Admin\AppData\Roaming\Download\513043.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\513043.exe"C:\Users\Admin\AppData\Roaming\Download\513043.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\742942.exe"C:\Users\Admin\AppData\Roaming\Download\742942.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\742942.exe"C:\Users\Admin\AppData\Roaming\Download\742942.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\814800.exe"C:\Users\Admin\AppData\Roaming\Download\814800.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\814800.exe"C:\Users\Admin\AppData\Roaming\Download\814800.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\073807.exe"C:\Users\Admin\AppData\Roaming\Download\073807.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\073807.exe"C:\Users\Admin\AppData\Roaming\Download\073807.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\461511.exe"C:\Users\Admin\AppData\Roaming\Download\461511.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\461511.exe"C:\Users\Admin\AppData\Roaming\Download\461511.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\938309.exe"C:\Users\Admin\AppData\Roaming\Download\938309.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\938309.exe"C:\Users\Admin\AppData\Roaming\Download\938309.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\084381.exe"C:\Users\Admin\AppData\Roaming\Download\084381.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\084381.exe"C:\Users\Admin\AppData\Roaming\Download\084381.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\078639.exe"C:\Users\Admin\AppData\Roaming\Download\078639.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\078639.exe"C:\Users\Admin\AppData\Roaming\Download\078639.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\669341.exe"C:\Users\Admin\AppData\Roaming\Download\669341.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\669341.exe"C:\Users\Admin\AppData\Roaming\Download\669341.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\163872.exe"C:\Users\Admin\AppData\Roaming\Download\163872.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\163872.exe"C:\Users\Admin\AppData\Roaming\Download\163872.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\553596.exe"C:\Users\Admin\AppData\Roaming\Download\553596.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\553596.exe"C:\Users\Admin\AppData\Roaming\Download\553596.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\809579.exe"C:\Users\Admin\AppData\Roaming\Download\809579.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\809579.exe"C:\Users\Admin\AppData\Roaming\Download\809579.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\208181.exe"C:\Users\Admin\AppData\Roaming\Download\208181.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\208181.exe"C:\Users\Admin\AppData\Roaming\Download\208181.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\323163.exe"C:\Users\Admin\AppData\Roaming\Download\323163.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\323163.exe"C:\Users\Admin\AppData\Roaming\Download\323163.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb1cc0c188,0x7ffb1cc0c194,0x7ffb1cc0c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,14630129177765626796,12601643937385725163,262144 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,11603350794005392193,18373545267690356224,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,4988472452041117024,8110518063084255583,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,9170010526644326614,15750209904063658334,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,4582775903529642175,8004749100751163594,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,11286360759102052286,17253847926616960750,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,8917840493209467138,14303293444277462204,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13804646583700885299,4277090451953597820,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5524,i,9553308955343934670,3276229242321643576,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,1047444004399693809,8235882028577608600,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12729692649061827341,15530251646756834300,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1548342625144573040,4450703435191261853,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5284201452814653801,3833633334739787435,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,362945259401826904,4926487775778870456,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1548342625144573040,4450703435191261853,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,15908942813044407115,2853063221702608859,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,17282475416124930385,11051327668298082322,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6932,i,7624852621737347049,2023506889361295432,2097152 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,6405609360495943192,5780085387115492580,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,4382075275917437164,11176865717074621869,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,14777234332641238707,4893126688827862215,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,13813301820296216828,12349000592578266854,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,7464130795318961088,4057915014591688974,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,472985328676056148,15506818963476303251,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,5112695850481002590,246464256594652166,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1544865251755399605,12484222065230752186,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3692,i,14630574107465669260,7525800403463870326,262144 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,209569283164115222,14590436279904462194,524288 --field-trial-handle=2272,i,14442168665269746603,16847202159051922391,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
02cdaf85-b1d6-4f08-bcbe-3df63f5f6db6.tmp
10a3c57b-7a11-4618-84b4-ea31e71e0fbc.tmp
4326676a-cfdb-492f-a864-c7d60db80000.tmp
4b641dfc-5ff0-4098-b248-1ab20d228d51.tmp
6ffa047a-3fc6-438f-9649-0dfeddc95e71.tmp
settings.dat
settings.dat
1054d1fb-1dc0-4fcb-97de-66282a28ef8a.tmp
1d4fb140-0925-4ff7-b06c-c4ca0b577b86.tmp
5efc9c54-875d-473d-be64-0fc333b905dc.tmp
f_000071
temp-index
the-real-index
6508ee6e-3ff1-4481-ab25-32a47e850cfb.tmp
dasherSettingSchema.json
691ee992-6664-45fb-abaa-981543ab497b.tmp
d369e4e2-ec48-4c24-b735-d0a4f80daf8d.tmp
e6493c88-df2e-486c-aca5-bb560f1d7be8.tmp
sync_diagnostic.log
c60c94df-7658-468d-af19-10a6a34ad120.tmp
c9c8e6e7-5e41-4690-a0c7-e3bf3aa9b0c3.tmp
d8281a4f-8f70-4ac8-b1be-2d4795efbcb2.tmp
81b4eb74-c954-4ae1-8030-6cb15d7ca302.tmp
OperationConfig
0d9e4183-4796-4252-b98f-b99adb4989cd.tmp
ebf6bc38-514b-488f-bbb1-dd3ab418da90.tmp
e3bdd710-1a86-42ab-a811-7cc822853804.tmp
2b3b4852-bf1f-4f28-ac28-102cafe85e65.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
sed_api_weather_info[1].htm
time[1].js
9b030c80-df69-4289-9ef0-88c00b96525c.tmp
a153f97d-807b-4eef-98f3-a2632de6cbcd.tmp
ldsajdklsajdlkjsalkda.bat
roukpw.exe
messages.json
content.js
138347.exe
224741.exe
259392.exe
422881.exe
522779.exe
558976.exe
640906.exe
654914.exe
710495.exe
722110.exe
753548.exe
760404.exe
880700.exe
manifest.json
manifest.json
manifest.json
memory/1364-1120-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1338-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1211-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-983-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1253-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-359-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1309-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1161-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1091-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1375-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-892-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1421-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1364-1450-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1736-195-0x0000000000400000-0x000000000059A000-memory.dmp