Analysis
- max time kernel
116s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 03:27
General
- Target 2026-11-01_f1c7b1e90a7e412dc125c89cbe419381_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261102-dz36faew7t
- SHA256 0279bb5bb0fab29c3309b3ac07f80d0ce85ed1ebcb7e245a13159359a89f5be4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 44 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f1c7b1e90a7e412dc125c89cbe419381_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f1c7b1e90a7e412dc125c89cbe419381_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\rzckug.exe"C:\Users\Admin\AppData\Local\Temp\rzckug.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rzckug.exe"C:\Users\Admin\AppData\Local\Temp\rzckug.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\927043.exe"C:\Users\Admin\AppData\Roaming\Download\927043.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\927043.exe"C:\Users\Admin\AppData\Roaming\Download\927043.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\972340.exe"C:\Users\Admin\AppData\Roaming\Download\972340.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\972340.exe"C:\Users\Admin\AppData\Roaming\Download\972340.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\446402.exe"C:\Users\Admin\AppData\Roaming\Download\446402.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\446402.exe"C:\Users\Admin\AppData\Roaming\Download\446402.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\990503.exe"C:\Users\Admin\AppData\Roaming\Download\990503.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\990503.exe"C:\Users\Admin\AppData\Roaming\Download\990503.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\435859.exe"C:\Users\Admin\AppData\Roaming\Download\435859.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\435859.exe"C:\Users\Admin\AppData\Roaming\Download\435859.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\308623.exe"C:\Users\Admin\AppData\Roaming\Download\308623.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\308623.exe"C:\Users\Admin\AppData\Roaming\Download\308623.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\867422.exe"C:\Users\Admin\AppData\Roaming\Download\867422.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\867422.exe"C:\Users\Admin\AppData\Roaming\Download\867422.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\188852.exe"C:\Users\Admin\AppData\Roaming\Download\188852.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\188852.exe"C:\Users\Admin\AppData\Roaming\Download\188852.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\680163.exe"C:\Users\Admin\AppData\Roaming\Download\680163.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\680163.exe"C:\Users\Admin\AppData\Roaming\Download\680163.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\281075.exe"C:\Users\Admin\AppData\Roaming\Download\281075.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\281075.exe"C:\Users\Admin\AppData\Roaming\Download\281075.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\927048.exe"C:\Users\Admin\AppData\Roaming\Download\927048.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\927048.exe"C:\Users\Admin\AppData\Roaming\Download\927048.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\810599.exe"C:\Users\Admin\AppData\Roaming\Download\810599.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\810599.exe"C:\Users\Admin\AppData\Roaming\Download\810599.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\453933.exe"C:\Users\Admin\AppData\Roaming\Download\453933.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\453933.exe"C:\Users\Admin\AppData\Roaming\Download\453933.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\902712.exe"C:\Users\Admin\AppData\Roaming\Download\902712.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\902712.exe"C:\Users\Admin\AppData\Roaming\Download\902712.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\151611.exe"C:\Users\Admin\AppData\Roaming\Download\151611.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\151611.exe"C:\Users\Admin\AppData\Roaming\Download\151611.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\795955.exe"C:\Users\Admin\AppData\Roaming\Download\795955.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\795955.exe"C:\Users\Admin\AppData\Roaming\Download\795955.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\499586.exe"C:\Users\Admin\AppData\Roaming\Download\499586.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\499586.exe"C:\Users\Admin\AppData\Roaming\Download\499586.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\758363.exe"C:\Users\Admin\AppData\Roaming\Download\758363.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\758363.exe"C:\Users\Admin\AppData\Roaming\Download\758363.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\007162.exe"C:\Users\Admin\AppData\Roaming\Download\007162.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\007162.exe"C:\Users\Admin\AppData\Roaming\Download\007162.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\842508.exe"C:\Users\Admin\AppData\Roaming\Download\842508.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\842508.exe"C:\Users\Admin\AppData\Roaming\Download\842508.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\865267.exe"C:\Users\Admin\AppData\Roaming\Download\865267.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\865267.exe"C:\Users\Admin\AppData\Roaming\Download\865267.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\369896.exe"C:\Users\Admin\AppData\Roaming\Download\369896.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\369896.exe"C:\Users\Admin\AppData\Roaming\Download\369896.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\715778.exe"C:\Users\Admin\AppData\Roaming\Download\715778.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\715778.exe"C:\Users\Admin\AppData\Roaming\Download\715778.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\841751.exe"C:\Users\Admin\AppData\Roaming\Download\841751.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\841751.exe"C:\Users\Admin\AppData\Roaming\Download\841751.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\996933.exe"C:\Users\Admin\AppData\Roaming\Download\996933.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\996933.exe"C:\Users\Admin\AppData\Roaming\Download\996933.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\732389.exe"C:\Users\Admin\AppData\Roaming\Download\732389.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\732389.exe"C:\Users\Admin\AppData\Roaming\Download\732389.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\081156.exe"C:\Users\Admin\AppData\Roaming\Download\081156.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\081156.exe"C:\Users\Admin\AppData\Roaming\Download\081156.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\489871.exe"C:\Users\Admin\AppData\Roaming\Download\489871.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\489871.exe"C:\Users\Admin\AppData\Roaming\Download\489871.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\042584.exe"C:\Users\Admin\AppData\Roaming\Download\042584.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\042584.exe"C:\Users\Admin\AppData\Roaming\Download\042584.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\545895.exe"C:\Users\Admin\AppData\Roaming\Download\545895.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\545895.exe"C:\Users\Admin\AppData\Roaming\Download\545895.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\179249.exe"C:\Users\Admin\AppData\Roaming\Download\179249.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\179249.exe"C:\Users\Admin\AppData\Roaming\Download\179249.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\338048.exe"C:\Users\Admin\AppData\Roaming\Download\338048.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\338048.exe"C:\Users\Admin\AppData\Roaming\Download\338048.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\908753.exe"C:\Users\Admin\AppData\Roaming\Download\908753.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\908753.exe"C:\Users\Admin\AppData\Roaming\Download\908753.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\422262.exe"C:\Users\Admin\AppData\Roaming\Download\422262.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\422262.exe"C:\Users\Admin\AppData\Roaming\Download\422262.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\761161.exe"C:\Users\Admin\AppData\Roaming\Download\761161.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\761161.exe"C:\Users\Admin\AppData\Roaming\Download\761161.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\250075.exe"C:\Users\Admin\AppData\Roaming\Download\250075.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\250075.exe"C:\Users\Admin\AppData\Roaming\Download\250075.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\753304.exe"C:\Users\Admin\AppData\Roaming\Download\753304.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\753304.exe"C:\Users\Admin\AppData\Roaming\Download\753304.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\144018.exe"C:\Users\Admin\AppData\Roaming\Download\144018.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\144018.exe"C:\Users\Admin\AppData\Roaming\Download\144018.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\082360.exe"C:\Users\Admin\AppData\Roaming\Download\082360.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\082360.exe"C:\Users\Admin\AppData\Roaming\Download\082360.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\586879.exe"C:\Users\Admin\AppData\Roaming\Download\586879.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\586879.exe"C:\Users\Admin\AppData\Roaming\Download\586879.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\702852.exe"C:\Users\Admin\AppData\Roaming\Download\702852.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\702852.exe"C:\Users\Admin\AppData\Roaming\Download\702852.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\545107.exe"C:\Users\Admin\AppData\Roaming\Download\545107.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\545107.exe"C:\Users\Admin\AppData\Roaming\Download\545107.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\704095.exe"C:\Users\Admin\AppData\Roaming\Download\704095.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\704095.exe"C:\Users\Admin\AppData\Roaming\Download\704095.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\950987.exe"C:\Users\Admin\AppData\Roaming\Download\950987.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\950987.exe"C:\Users\Admin\AppData\Roaming\Download\950987.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\585323.exe"C:\Users\Admin\AppData\Roaming\Download\585323.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\585323.exe"C:\Users\Admin\AppData\Roaming\Download\585323.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\289932.exe"C:\Users\Admin\AppData\Roaming\Download\289932.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\289932.exe"C:\Users\Admin\AppData\Roaming\Download\289932.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,18227261971637576100,16597005950226817720,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1863406482752737228,1025259356212781483,262144 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,1070798256660461029,16491547718770833393,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11559462440416735058,12404100495952846479,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,4461122234482908194,18019608155727208454,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,4802911020622690283,8098563146116032879,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,504140068678986084,4113909904419794482,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,9808181961887798651,8512462787907886796,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3856,i,9154107029566322227,8577556072694246149,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,10581402225589535929,16285577182020799204,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,217621517904328126,12957392665658196682,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6405613472437731468,6496294775634124407,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6405613472437731468,6496294775634124407,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,10032129884356596097,6369138821774709421,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,2144581351072468890,11266458140785584827,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,9895147956261439399,756102544575892544,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,1652744165728060320,533706416947523566,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6476,i,11537854235439116322,13462877255672330919,2097152 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,2340598072628374314,15327579917734817524,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,13230916431543656907,7778814495815355868,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,115500874437573736,16866474921162242667,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12465812165976876927,7814388545962459450,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,7154176958308386732,11805942008414118395,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,9696800311049083662,13317269813038374096,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16400387781300394939,14797606784043235343,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,15721243258824097875,2796851912656418133,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,16746629960173891602,213584982145244114,262144 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,18187730422045373425,17734918641674410136,524288 --field-trial-handle=2232,i,9501697736474742169,7050948305076658785,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
60580819-275f-42e6-b0c9-ce8de515f92d.tmp
72122bdd-3788-4c01-8a18-87da1cc982a8.tmp
9adea7a3-7adc-44da-90f5-09271b19f77c.tmp
settings.dat
settings.dat
0405f36b-e8cc-4e94-8c1f-e52d0f7d7d1e.tmp
3e7e9f44-1e03-4924-b114-9870eedc3368.tmp
3eafd4e2-8a04-4772-a7a5-c8e00bad8759.tmp
8f101901-8db5-4597-9c3c-ba4b4d4673cc.tmp
99eba73e-fead-4810-b48f-1c01f47cf83a.tmp
the-real-index
c6c42d58-2b4d-4cab-a1c3-8f3d6fd9120d.tmp
dasherSettingSchema.json
7754d391-1ded-4cda-b812-794c25bf0ff7.tmp
a7c3aa16-cbd6-4ced-9b75-789d01478600.tmp
b4f12103-e6ed-4112-b7ff-026de8bb5c88.tmp
sync_diagnostic.log
b8bd8790-2d24-43c5-861f-7b94ef31b135.tmp
OperationConfig
b2018599-575b-489a-8d57-b0b98dff7772.tmp
b29db220-bd76-4c02-bff6-64f9dfb0ea77.tmp
35188fd5-6741-4bd1-a18d-2a3d6f0e00ba.tmp
c4003c3d-98a1-4457-93b5-5f49af1c3aed.tmp
de6048a4-dcb1-4a96-b4b1-a2f0f759111d.tmp
e5fc6d78-abff-4591-adc9-b18a77a1d142.tmp
ea37eb1c-b89c-442b-8794-b6411b9c7644.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
596a9e70-a68f-4036-bb13-50e19c7e3234.tmp
metadata.json
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
113[1].js
0[1].png
10e700d9-df84-4a28-b306-e9b429509adc.tmp
57634840-112b-40fa-970c-6cdbd85d5f65.tmp
ldsajdklsajdlkjsalkda.bat
rzckug.exe
content.js
messages.json
188852.exe
281075.exe
308623.exe
435859.exe
446402.exe
453933.exe
680163.exe
810599.exe
867422.exe
927043.exe
927048.exe
972340.exe
990503.exe
manifest.json
manifest.json
manifest.json
memory/704-923-0x000001DF1EBF0000-0x000001DF1EFAB000-memory.dmp
memory/704-880-0x000001DF1EBF0000-0x000001DF1EFAB000-memory.dmp
memory/2556-1136-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2556-1052-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2556-373-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2556-959-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2556-894-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2556-1515-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4312-20-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4896-147-0x0000000000400000-0x000000000059A000-memory.dmp