Analysis
- max time kernel
129s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 23:14
General
- Target 2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261020-275agags2x
- SHA256 17e61cb810e5e783020d1c5d2e6d2b5cb52c74a9e1d3466d238951382557f7ff
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 38 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\tlwhye.exe"C:\Users\Admin\AppData\Local\Temp\tlwhye.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tlwhye.exe"C:\Users\Admin\AppData\Local\Temp\tlwhye.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\565382.exe"C:\Users\Admin\AppData\Roaming\Download\565382.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\565382.exe"C:\Users\Admin\AppData\Roaming\Download\565382.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\936549.exe"C:\Users\Admin\AppData\Roaming\Download\936549.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\936549.exe"C:\Users\Admin\AppData\Roaming\Download\936549.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\197422.exe"C:\Users\Admin\AppData\Roaming\Download\197422.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\197422.exe"C:\Users\Admin\AppData\Roaming\Download\197422.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\972340.exe"C:\Users\Admin\AppData\Roaming\Download\972340.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\972340.exe"C:\Users\Admin\AppData\Roaming\Download\972340.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\618510.exe"C:\Users\Admin\AppData\Roaming\Download\618510.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\618510.exe"C:\Users\Admin\AppData\Roaming\Download\618510.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\939332.exe"C:\Users\Admin\AppData\Roaming\Download\939332.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\939332.exe"C:\Users\Admin\AppData\Roaming\Download\939332.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\025553.exe"C:\Users\Admin\AppData\Roaming\Download\025553.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\025553.exe"C:\Users\Admin\AppData\Roaming\Download\025553.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\030629.exe"C:\Users\Admin\AppData\Roaming\Download\030629.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\030629.exe"C:\Users\Admin\AppData\Roaming\Download\030629.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\734150.exe"C:\Users\Admin\AppData\Roaming\Download\734150.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\734150.exe"C:\Users\Admin\AppData\Roaming\Download\734150.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\367504.exe"C:\Users\Admin\AppData\Roaming\Download\367504.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\367504.exe"C:\Users\Admin\AppData\Roaming\Download\367504.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\626473.exe"C:\Users\Admin\AppData\Roaming\Download\626473.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\626473.exe"C:\Users\Admin\AppData\Roaming\Download\626473.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\320912.exe"C:\Users\Admin\AppData\Roaming\Download\320912.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\320912.exe"C:\Users\Admin\AppData\Roaming\Download\320912.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\559701.exe"C:\Users\Admin\AppData\Roaming\Download\559701.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\559701.exe"C:\Users\Admin\AppData\Roaming\Download\559701.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\957405.exe"C:\Users\Admin\AppData\Roaming\Download\957405.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\957405.exe"C:\Users\Admin\AppData\Roaming\Download\957405.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\783849.exe"C:\Users\Admin\AppData\Roaming\Download\783849.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\783849.exe"C:\Users\Admin\AppData\Roaming\Download\783849.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\155365.exe"C:\Users\Admin\AppData\Roaming\Download\155365.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\155365.exe"C:\Users\Admin\AppData\Roaming\Download\155365.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\543277.exe"C:\Users\Admin\AppData\Roaming\Download\543277.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\543277.exe"C:\Users\Admin\AppData\Roaming\Download\543277.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\691150.exe"C:\Users\Admin\AppData\Roaming\Download\691150.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\691150.exe"C:\Users\Admin\AppData\Roaming\Download\691150.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\027132.exe"C:\Users\Admin\AppData\Roaming\Download\027132.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\027132.exe"C:\Users\Admin\AppData\Roaming\Download\027132.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\680568.exe"C:\Users\Admin\AppData\Roaming\Download\680568.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\680568.exe"C:\Users\Admin\AppData\Roaming\Download\680568.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\665623.exe"C:\Users\Admin\AppData\Roaming\Download\665623.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\665623.exe"C:\Users\Admin\AppData\Roaming\Download\665623.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\513986.exe"C:\Users\Admin\AppData\Roaming\Download\513986.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\513986.exe"C:\Users\Admin\AppData\Roaming\Download\513986.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\902500.exe"C:\Users\Admin\AppData\Roaming\Download\902500.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\902500.exe"C:\Users\Admin\AppData\Roaming\Download\902500.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\261487.exe"C:\Users\Admin\AppData\Roaming\Download\261487.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\261487.exe"C:\Users\Admin\AppData\Roaming\Download\261487.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\751092.exe"C:\Users\Admin\AppData\Roaming\Download\751092.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\751092.exe"C:\Users\Admin\AppData\Roaming\Download\751092.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\142706.exe"C:\Users\Admin\AppData\Roaming\Download\142706.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\142706.exe"C:\Users\Admin\AppData\Roaming\Download\142706.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\644235.exe"C:\Users\Admin\AppData\Roaming\Download\644235.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\644235.exe"C:\Users\Admin\AppData\Roaming\Download\644235.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\830682.exe"C:\Users\Admin\AppData\Roaming\Download\830682.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\830682.exe"C:\Users\Admin\AppData\Roaming\Download\830682.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\352911.exe"C:\Users\Admin\AppData\Roaming\Download\352911.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\352911.exe"C:\Users\Admin\AppData\Roaming\Download\352911.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\732825.exe"C:\Users\Admin\AppData\Roaming\Download\732825.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\732825.exe"C:\Users\Admin\AppData\Roaming\Download\732825.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\081624.exe"C:\Users\Admin\AppData\Roaming\Download\081624.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\081624.exe"C:\Users\Admin\AppData\Roaming\Download\081624.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\582337.exe"C:\Users\Admin\AppData\Roaming\Download\582337.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\582337.exe"C:\Users\Admin\AppData\Roaming\Download\582337.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\115783.exe"C:\Users\Admin\AppData\Roaming\Download\115783.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\115783.exe"C:\Users\Admin\AppData\Roaming\Download\115783.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\681193.exe"C:\Users\Admin\AppData\Roaming\Download\681193.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\681193.exe"C:\Users\Admin\AppData\Roaming\Download\681193.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\426449.exe"C:\Users\Admin\AppData\Roaming\Download\426449.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\426449.exe"C:\Users\Admin\AppData\Roaming\Download\426449.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\773316.exe"C:\Users\Admin\AppData\Roaming\Download\773316.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\773316.exe"C:\Users\Admin\AppData\Roaming\Download\773316.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\442589.exe"C:\Users\Admin\AppData\Roaming\Download\442589.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\442589.exe"C:\Users\Admin\AppData\Roaming\Download\442589.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\877561.exe"C:\Users\Admin\AppData\Roaming\Download\877561.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\877561.exe"C:\Users\Admin\AppData\Roaming\Download\877561.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\168273.exe"C:\Users\Admin\AppData\Roaming\Download\168273.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\168273.exe"C:\Users\Admin\AppData\Roaming\Download\168273.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\528979.exe"C:\Users\Admin\AppData\Roaming\Download\528979.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\528979.exe"C:\Users\Admin\AppData\Roaming\Download\528979.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\119581.exe"C:\Users\Admin\AppData\Roaming\Download\119581.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\119581.exe"C:\Users\Admin\AppData\Roaming\Download\119581.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\365764.exe"C:\Users\Admin\AppData\Roaming\Download\365764.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\365764.exe"C:\Users\Admin\AppData\Roaming\Download\365764.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\800900.exe"C:\Users\Admin\AppData\Roaming\Download\800900.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\800900.exe"C:\Users\Admin\AppData\Roaming\Download\800900.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\236082.exe"C:\Users\Admin\AppData\Roaming\Download\236082.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\236082.exe"C:\Users\Admin\AppData\Roaming\Download\236082.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\005040.exe"C:\Users\Admin\AppData\Roaming\Download\005040.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\005040.exe"C:\Users\Admin\AppData\Roaming\Download\005040.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\509588.exe"C:\Users\Admin\AppData\Roaming\Download\509588.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\509588.exe"C:\Users\Admin\AppData\Roaming\Download\509588.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x368,0x7ff946b9c188,0x7ff946b9c194,0x7ff946b9c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,8527038552167177636,9353932487241714524,262144 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10756890607394914694,8392078033568391408,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,7853431437042476278,10311533606549275736,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,18436688659724753235,13974661183498081095,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,15347520149040337810,10382326030308892180,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5694145872589417905,3637125812140893290,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14519137443445029772,17864548039009669855,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,6482488817617595396,14106108282374357834,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5520,i,16962061889795315812,16886209892352259304,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2723295533415766725,12290557057187691606,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2723295533415766725,12290557057187691606,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,1990882862664272252,1037370576893104510,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,17437975873996898757,18328793013276914998,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16882204792370238769,2965902238076772539,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1166147187726021668,673169229279585554,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,13795485792725505398,13581119019535006100,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7990452176967674077,13447496285622117723,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,4080659669258390917,2039610165064062346,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,3135266536707236968,13172401887287090109,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6764,i,10753407910661483501,8834933092157679888,2097152 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3838012642164016011,5549057155869891616,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,12225027790862625844,3994047159861900928,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,15418342081917282496,15252184884682732097,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7905825914465236591,7457178718109385043,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,9516797887385610403,1463252487533215218,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,486133689060960655,11872622707492625934,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,13397177252660498198,544258025713127014,262144 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5554294163600786105,3831252940844053806,524288 --field-trial-handle=2540,i,17024241240689721172,9986604515088385340,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
1251fd42-3e1e-4b2e-8d44-b3034945ad27.tmp
1b0a6054-1842-4a10-9c79-115a7725ca2e.tmp
1bb5cac1-9343-4ecd-890e-4e69e9bfc1ed.tmp
49ea61d1-15f6-436d-9f18-6b68d1a3ea65.tmp
837f0ed5-ca16-4e7a-987d-75f9f495edf8.tmp
149d3cb5-34c3-4787-a640-29ec8f3b7964.tmp
settings.dat
settings.dat
3259f469-953f-4d4b-b554-c84f5f8dadba.tmp
758fd41d-7ca9-4d48-a2d7-5a597eed149a.tmp
87e136a5-6f1c-4588-be1f-d2c8340b18b8.tmp
f_00004b
temp-index
the-real-index
0cec6c1c-6ebd-4078-a3ad-603b99d8f1bf.tmp
dasherSettingSchema.json
180d4a18-651e-48cf-bfe3-9d0712aaa21e.tmp
7fb69468-d7cb-4f3e-85fe-cdd7dfb32d92.tmp
d0f250f4-d350-452d-b758-c7bfad0d0921.tmp
sync_diagnostic.log
cbf9bd45-691f-4aeb-bbbe-6355726ca695.tmp
e4d6f274-72c6-442b-b763-20167a74673f.tmp
e79d0869-3999-4a4b-b24b-e2408e2eca4d.tmp
2c41b260-ff18-4187-8ce7-3709bf2f4be8.tmp
OperationConfig
30467b17-2ee8-4314-a25a-16d09b4ab949.tmp
352b1686-93f4-4e7a-a61c-52a1585372ea.tmp
803bfc53-f5d4-474c-999c-3f093a2a93a6.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
8ab1f4d9-e8db-4228-a224-d3c8c0f10bb8.tmp
8edd443f-cfd7-4487-b7b4-2a7dcb894f5d.tmp
hao.360[1].xml
hao.360[1].xml
0[1].png
sed_api_weather_info[1].htm
time[1].js
00d7215c-75d5-4db7-8bbb-e5404ca593aa.tmp
60133368-26b3-4645-8e06-e0b7633da7c7.tmp
ldsajdklsajdlkjsalkda.bat
content.js
messages.json
tlwhye.exe
025553.exe
030629.exe
197422.exe
320912.exe
367504.exe
559701.exe
565382.exe
618510.exe
626473.exe
734150.exe
936549.exe
939332.exe
972340.exe
manifest.json
manifest.json
manifest.json
memory/1852-1115-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-903-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1235-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1010-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1286-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1144-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1333-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1185-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1370-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-388-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1415-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1454-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1059-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1852-1491-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2628-196-0x0000000000400000-0x000000000059A000-memory.dmp