b8d4672bf06fd76d7589aad93c1658dd96862d693cd8dfc584715a1e3c215517

Analysis

max time kernel
78s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
Size 1.5MB
Sample260723-albbqas1ev
SHA256 b8d4672bf06fd76d7589aad93c1658dd96862d693cd8dfc584715a1e3c215517
MD5 226a6977d9c94fd7d2ae5fc96237718d
SHA1 a7676b2db6a26fbba141e486c4ee5ab36e6cb4c1
SHA512 fa4194810c9dbbe1de35b1d42fa90a5eeadeb4999edf7cfddb101a72d482ff04fe4dad570aeaaf28b3ca8e6f495f24d630a8e11fbcd96d496477359a2d216294
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdO:01/kjtPlERDGnlRANRdO
TLSH
T126757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 39 IoCs

pid	Process
1968	DouTuDaShi.exe
1436	crhuos.exe
5540	crhuos.exe
4436	640906.exe
3956	640906.exe
5416	830501.exe
4428	830501.exe
3592	011647.exe
5840	011647.exe
3272	378089.exe
1232	378089.exe
3388	186947.exe
4968	186947.exe
760	545304.exe
4340	545304.exe
2652	945163.exe
1640	945163.exe
5076	866122.exe
3320	866122.exe
800	084545.exe
4084	084545.exe
4580	689063.exe
2116	689063.exe
4340	425316.exe
3616	425316.exe
1628	923798.exe
4952	923798.exe
3676	773955.exe
4012	773955.exe
4352	630915.exe
4288	630915.exe
4204	858421.exe
2436	858421.exe
5492	496594.exe
4712	496594.exe
4300	201720.exe
4552	201720.exe
1996	846166.exe
2480	846166.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DouTu\DouTuDaShi.exe	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	866122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crhuos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	640906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	011647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	084545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	945163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	084545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	689063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	773955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	186947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	866122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	011647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	378089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	689063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	858421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crhuos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	378089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	846166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DouTuDaShi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	640906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	545304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	545304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	923798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	858421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	201720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	186947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	923798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	773955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	630915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	630915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	201720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	846166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292394748623554"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{D42CD3EB-533B-4CA5-B715-D2B06D2A8E75}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{6C37F18A-E4F9-47F6-A34C-B1D388F1B83F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe
5540	crhuos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5828	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1968	DouTuDaShi.exe
1968	DouTuDaShi.exe
1968	DouTuDaShi.exe
1968	DouTuDaShi.exe
4832	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1968	4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe	89
PID 4840 wrote to memory of 1436	4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe	90
PID 1436 wrote to memory of 5540	1436	crhuos.exe	91
PID 5540 wrote to memory of 4436	5540	crhuos.exe	92
PID 4436 wrote to memory of 3956	4436	640906.exe	93
PID 4840 wrote to memory of 5828	4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe	94
PID 4840 wrote to memory of 6120	4840	2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe	95
PID 5828 wrote to memory of 2040	5828	msedge.exe	96
PID 5828 wrote to memory of 1712	5828	msedge.exe	98
PID 5828 wrote to memory of 2148	5828	msedge.exe	100
PID 5828 wrote to memory of 1712	5828	msedge.exe	98
PID 5828 wrote to memory of 1712	5828	msedge.exe	98
PID 5828 wrote to memory of 5436	5828	msedge.exe	101
PID 5828 wrote to memory of 5436	5828	msedge.exe	101
PID 4832 wrote to memory of 5840	4832	explorer.exe	127
PID 5828 wrote to memory of 3592	5828	msedge.exe	118
PID 5828 wrote to memory of 3592	5828	msedge.exe	118
PID 5828 wrote to memory of 3592	5828	msedge.exe	118
PID 5828 wrote to memory of 2796	5828	msedge.exe	104
PID 5828 wrote to memory of 2796	5828	msedge.exe	104
PID 5828 wrote to memory of 2796	5828	msedge.exe	104
PID 5828 wrote to memory of 3888	5828	msedge.exe	106
PID 5828 wrote to memory of 3888	5828	msedge.exe	106
PID 5828 wrote to memory of 3888	5828	msedge.exe	106
PID 5828 wrote to memory of 1664	5828	msedge.exe	107
PID 5828 wrote to memory of 1664	5828	msedge.exe	107
PID 5828 wrote to memory of 1664	5828	msedge.exe	107
PID 5828 wrote to memory of 1536	5828	msedge.exe	108
PID 5828 wrote to memory of 1536	5828	msedge.exe	108
PID 5540 wrote to memory of 5416	5540	crhuos.exe	110
PID 5416 wrote to memory of 4428	5416	830501.exe	111
PID 5828 wrote to memory of 1120	5828	msedge.exe	112
PID 5828 wrote to memory of 1120	5828	msedge.exe	112
PID 5828 wrote to memory of 1120	5828	msedge.exe	112
PID 5828 wrote to memory of 3468	5828	msedge.exe	113
PID 5828 wrote to memory of 3876	5828	msedge.exe	114
PID 5828 wrote to memory of 3468	5828	msedge.exe	113
PID 5828 wrote to memory of 3876	5828	msedge.exe	114
PID 5828 wrote to memory of 5332	5828	msedge.exe	116
PID 5540 wrote to memory of 3592	5540	crhuos.exe	118
PID 5828 wrote to memory of 2660	5828	msedge.exe	119
PID 5828 wrote to memory of 556	5828	msedge.exe	120
PID 5828 wrote to memory of 556	5828	msedge.exe	120
PID 3592 wrote to memory of 5840	3592	011647.exe	127
PID 5828 wrote to memory of 4968	5828	msedge.exe	129
PID 5828 wrote to memory of 4968	5828	msedge.exe	129
PID 5540 wrote to memory of 3272	5540	crhuos.exe	124
PID 3272 wrote to memory of 1232	3272	378089.exe	125
PID 5828 wrote to memory of 1608	5828	msedge.exe	126
PID 5828 wrote to memory of 1608	5828	msedge.exe	126
PID 5828 wrote to memory of 1608	5828	msedge.exe	126
PID 5540 wrote to memory of 3388	5540	crhuos.exe	128
PID 3388 wrote to memory of 4968	3388	186947.exe	129
PID 5828 wrote to memory of 3936	5828	msedge.exe	130
PID 5828 wrote to memory of 5616	5828	msedge.exe	131
PID 5828 wrote to memory of 4952	5828	msedge.exe	148
PID 5828 wrote to memory of 6136	5828	msedge.exe	153
PID 5828 wrote to memory of 6136	5828	msedge.exe	153
PID 5540 wrote to memory of 760	5540	crhuos.exe	135
PID 760 wrote to memory of 4340	760	545304.exe	145
PID 5540 wrote to memory of 2652	5540	crhuos.exe	137
PID 2652 wrote to memory of 1640	2652	945163.exe	138
PID 5540 wrote to memory of 5076	5540	crhuos.exe	139
PID 5076 wrote to memory of 3320	5076	866122.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_226a6977d9c94fd7d2ae5fc96237718d_elex_emotet_icedid_krbanker_remcos_stop.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\DouTu\DouTuDaShi.exe
  "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\crhuos.exe
  "C:\Users\Admin\AppData\Local\Temp\crhuos.exe" /jscxyxztjkl
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\crhuos.exe
    "C:\Users\Admin\AppData\Local\Temp\crhuos.exe" /jsjczxztcq
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Users\Admin\AppData\Roaming\Download\640906.exe
      "C:\Users\Admin\AppData\Roaming\Download\640906.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4436
    - - C:\Users\Admin\AppData\Roaming\Download\640906.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\640906.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3956
  - - C:\Users\Admin\AppData\Roaming\Download\830501.exe
      "C:\Users\Admin\AppData\Roaming\Download\830501.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5416
    - - C:\Users\Admin\AppData\Roaming\Download\830501.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\830501.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4428
  - - C:\Users\Admin\AppData\Roaming\Download\011647.exe
      "C:\Users\Admin\AppData\Roaming\Download\011647.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Users\Admin\AppData\Roaming\Download\011647.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\011647.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5840
  - - C:\Users\Admin\AppData\Roaming\Download\378089.exe
      "C:\Users\Admin\AppData\Roaming\Download\378089.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Users\Admin\AppData\Roaming\Download\378089.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\378089.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1232
  - - C:\Users\Admin\AppData\Roaming\Download\186947.exe
      "C:\Users\Admin\AppData\Roaming\Download\186947.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Users\Admin\AppData\Roaming\Download\186947.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\186947.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
  - - C:\Users\Admin\AppData\Roaming\Download\545304.exe
      "C:\Users\Admin\AppData\Roaming\Download\545304.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Users\Admin\AppData\Roaming\Download\545304.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\545304.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4340
  - - C:\Users\Admin\AppData\Roaming\Download\945163.exe
      "C:\Users\Admin\AppData\Roaming\Download\945163.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Roaming\Download\945163.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\945163.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1640
  - - C:\Users\Admin\AppData\Roaming\Download\866122.exe
      "C:\Users\Admin\AppData\Roaming\Download\866122.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Users\Admin\AppData\Roaming\Download\866122.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\866122.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3320
  - - C:\Users\Admin\AppData\Roaming\Download\084545.exe
      "C:\Users\Admin\AppData\Roaming\Download\084545.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:800
    - - C:\Users\Admin\AppData\Roaming\Download\084545.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\084545.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4084
  - - C:\Users\Admin\AppData\Roaming\Download\689063.exe
      "C:\Users\Admin\AppData\Roaming\Download\689063.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4580
    - - C:\Users\Admin\AppData\Roaming\Download\689063.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\689063.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2116
  - - C:\Users\Admin\AppData\Roaming\Download\425316.exe
      "C:\Users\Admin\AppData\Roaming\Download\425316.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4340
    - - C:\Users\Admin\AppData\Roaming\Download\425316.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\425316.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3616
  - - C:\Users\Admin\AppData\Roaming\Download\923798.exe
      "C:\Users\Admin\AppData\Roaming\Download\923798.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1628
    - - C:\Users\Admin\AppData\Roaming\Download\923798.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\923798.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4952
  - - C:\Users\Admin\AppData\Roaming\Download\773955.exe
      "C:\Users\Admin\AppData\Roaming\Download\773955.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3676
    - - C:\Users\Admin\AppData\Roaming\Download\773955.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\773955.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
  - - C:\Users\Admin\AppData\Roaming\Download\630915.exe
      "C:\Users\Admin\AppData\Roaming\Download\630915.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4352
    - - C:\Users\Admin\AppData\Roaming\Download\630915.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\630915.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4288
  - - C:\Users\Admin\AppData\Roaming\Download\858421.exe
      "C:\Users\Admin\AppData\Roaming\Download\858421.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\Users\Admin\AppData\Roaming\Download\858421.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\858421.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2436
  - - C:\Users\Admin\AppData\Roaming\Download\496594.exe
      "C:\Users\Admin\AppData\Roaming\Download\496594.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\Users\Admin\AppData\Roaming\Download\496594.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\496594.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Users\Admin\AppData\Roaming\Download\201720.exe
      "C:\Users\Admin\AppData\Roaming\Download\201720.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\Users\Admin\AppData\Roaming\Download\201720.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\201720.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4552
  - - C:\Users\Admin\AppData\Roaming\Download\846166.exe
      "C:\Users\Admin\AppData\Roaming\Download\846166.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1996
    - - C:\Users\Admin\AppData\Roaming\Download\846166.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\846166.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2480
  - - C:\Users\Admin\AppData\Roaming\Download\348694.exe
      "C:\Users\Admin\AppData\Roaming\Download\348694.exe" /Shorttailedrestart
      4⤵
      PID:2584
    - - C:\Users\Admin\AppData\Roaming\Download\348694.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\348694.exe"
        5⤵
        
        PID:1016
  - - C:\Users\Admin\AppData\Roaming\Download\278746.exe
      "C:\Users\Admin\AppData\Roaming\Download\278746.exe" /Shorttailedrestart
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Roaming\Download\278746.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\278746.exe"
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Roaming\Download\915009.exe
      "C:\Users\Admin\AppData\Roaming\Download\915009.exe" /Shorttailedrestart
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Roaming\Download\915009.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\915009.exe"
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Roaming\Download\887966.exe
      "C:\Users\Admin\AppData\Roaming\Download\887966.exe" /Shorttailedrestart
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Roaming\Download\887966.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\887966.exe"
        5⤵
        
        PID:1356
  - - C:\Users\Admin\AppData\Roaming\Download\447680.exe
      "C:\Users\Admin\AppData\Roaming\Download\447680.exe" /Shorttailedrestart
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Roaming\Download\447680.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\447680.exe"
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Roaming\Download\473997.exe
      "C:\Users\Admin\AppData\Roaming\Download\473997.exe" /Shorttailedrestart
      4⤵
      PID:1972
    - - C:\Users\Admin\AppData\Roaming\Download\473997.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\473997.exe"
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Roaming\Download\458780.exe
      "C:\Users\Admin\AppData\Roaming\Download\458780.exe" /Shorttailedrestart
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Roaming\Download\458780.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\458780.exe"
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Roaming\Download\490171.exe
      "C:\Users\Admin\AppData\Roaming\Download\490171.exe" /Shorttailedrestart
      4⤵
      PID:4604
    - - C:\Users\Admin\AppData\Roaming\Download\490171.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\490171.exe"
        5⤵
        
        PID:2000
  - - C:\Users\Admin\AppData\Roaming\Download\992709.exe
      "C:\Users\Admin\AppData\Roaming\Download\992709.exe" /Shorttailedrestart
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Roaming\Download\992709.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\992709.exe"
        5⤵
        
        PID:1192
  - - C:\Users\Admin\AppData\Roaming\Download\495240.exe
      "C:\Users\Admin\AppData\Roaming\Download\495240.exe" /Shorttailedrestart
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Roaming\Download\495240.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\495240.exe"
        5⤵
        
        PID:5040
  - - C:\Users\Admin\AppData\Roaming\Download\058734.exe
      "C:\Users\Admin\AppData\Roaming\Download\058734.exe" /Shorttailedrestart
      4⤵
      PID:2608
    - - C:\Users\Admin\AppData\Roaming\Download\058734.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\058734.exe"
        5⤵
        
        PID:3148
  - - C:\Users\Admin\AppData\Roaming\Download\908811.exe
      "C:\Users\Admin\AppData\Roaming\Download\908811.exe" /Shorttailedrestart
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Roaming\Download\908811.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\908811.exe"
        5⤵
        
        PID:2500
  - - C:\Users\Admin\AppData\Roaming\Download\401420.exe
      "C:\Users\Admin\AppData\Roaming\Download\401420.exe" /Shorttailedrestart
      4⤵
      PID:1896
    - - C:\Users\Admin\AppData\Roaming\Download\401420.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\401420.exe"
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Roaming\Download\905751.exe
      "C:\Users\Admin\AppData\Roaming\Download\905751.exe" /Shorttailedrestart
      4⤵
      PID:4408
    - - C:\Users\Admin\AppData\Roaming\Download\905751.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\905751.exe"
        5⤵
        
        PID:1328
  - - C:\Users\Admin\AppData\Roaming\Download\017753.exe
      "C:\Users\Admin\AppData\Roaming\Download\017753.exe" /Shorttailedrestart
      4⤵
      PID:3648
    - - C:\Users\Admin\AppData\Roaming\Download\017753.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\017753.exe"
        5⤵
        
        PID:4860
  - - C:\Users\Admin\AppData\Roaming\Download\206240.exe
      "C:\Users\Admin\AppData\Roaming\Download\206240.exe" /Shorttailedrestart
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Roaming\Download\206240.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\206240.exe"
        5⤵
        
        PID:3324
  - - C:\Users\Admin\AppData\Roaming\Download\812496.exe
      "C:\Users\Admin\AppData\Roaming\Download\812496.exe" /Shorttailedrestart
      4⤵
      PID:828
    - - C:\Users\Admin\AppData\Roaming\Download\812496.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\812496.exe"
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Roaming\Download\371826.exe
      "C:\Users\Admin\AppData\Roaming\Download\371826.exe" /Shorttailedrestart
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Roaming\Download\371826.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\371826.exe"
        5⤵
        
        PID:5024
  - - C:\Users\Admin\AppData\Roaming\Download\976262.exe
      "C:\Users\Admin\AppData\Roaming\Download\976262.exe" /Shorttailedrestart
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Roaming\Download\976262.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\976262.exe"
        5⤵
        
        PID:3560
  - - C:\Users\Admin\AppData\Roaming\Download\707314.exe
      "C:\Users\Admin\AppData\Roaming\Download\707314.exe" /Shorttailedrestart
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Roaming\Download\707314.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\707314.exe"
        5⤵
        
        PID:1420
  - - C:\Users\Admin\AppData\Roaming\Download\653574.exe
      "C:\Users\Admin\AppData\Roaming\Download\653574.exe" /Shorttailedrestart
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Roaming\Download\653574.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\653574.exe"
        5⤵
        
        PID:1192
  - - C:\Users\Admin\AppData\Roaming\Download\364626.exe
      "C:\Users\Admin\AppData\Roaming\Download\364626.exe" /Shorttailedrestart
      4⤵
      PID:2636
    - - C:\Users\Admin\AppData\Roaming\Download\364626.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\364626.exe"
        5⤵
        
        PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffde44ac188,0x7ffde44ac194,0x7ffde44ac1a0
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,8357648772156030860,12338493475636157408,262144 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,12934489597974838997,13515220358792888619,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,1303597181441484837,2935310831002379260,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,611329693050370109,1680860162751282230,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,13437670905677493330,17121681137242054700,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,2295339334844999511,491181524323043716,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,18337056131228718492,12283181314893126284,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,13052923730305195834,6798084693954089039,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5416,i,2670787618768226557,15466510254111239107,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,13551278349705622440,9630999529612804799,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,8959540910598902799,18278995363597317753,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14541038411574345863,15678920130467503342,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14541038411574345863,15678920130467503342,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9956070795565417238,17098967716445743222,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    - Modifies registry class
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,12336087554267187265,2634899606413347722,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:12
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8903645893570479134,13525326573379529436,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4280,i,299908770354803662,10048816930702801955,2097152 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,18050671264822514797,14905167598284177819,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,12569957569004069480,7116813476410198981,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,9218566732320659464,8964143219087204248,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8159965911850778849,460437680991132933,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15036167282214457622,10672142182075038651,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,17427967801992310027,1076775509398663282,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,8113331040790495759,17020642885684665026,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,13575532770525888498,9073668200906259612,262144 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:10
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,17612179805163851465,18066269734742358556,524288 --field-trial-handle=2248,i,2919514867052053089,2123182034654394182,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:4712
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
  2⤵
  PID:6120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5440

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv eWg1oko+J06nGg8yFZICBg.0.2
1⤵
PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DouTuDaShi.exe

Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
Size 1.1MB
SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
MD5 ab71d658fafe7acc09e7de2116a85f89
SHA1 d1dd1a053f2c970bc4d0043bf3e682fbf2ea405f
SHA512 18651fbc489a877400b92beb95dd66c85285586bcbd84c392e2f67dbca9608ec207004a5ad7d8164c9c515cce45ee7628403300eae56786d556305725b9e9e27
SSDEEP 12288:tbbBGg1UbdQLMKZC8M0lZrGHjpRmWpsdLD46Dc92Rs0df7buvTPq/8sJMxlH:t/j1UbiLFZC8hlpG5p+LD4iRxaaTKH
TLSH
T1FD45CF75B5C7C0F2C612117008666B3AEB76BA5A0F29CFC3E3A6DE2C1D36141D93725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 03e52caf46c5529eb3d088c1249ba624baa9f06391e0fd4181529b6a42d07816
MD5 558e7a766b923aa55e8f34a2ad43c518
SHA1 bb5dbbf7a0aea5caec1c7cf2fbfaab9ab99cf76a
SHA512 85f636001a48289d2802b61e81b56d347970e38aa1ae7115d3d5ce8a921f2326246939caf0773bc9e2d12395403fc3c3c4a23fb25d2873e66fc97b3afab49c12
TLSH
T14C514E8B03F31FB2CF90A6B657E67C5A31F7D5FE15075E8A09885A38CBB63581144C18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ae62b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ae62b.TMP
Size 1KB
SHA256 669d59d54006b8f3dd4f1383237ee6c1bfc2915eba9047f67607051c859c5b7e
MD5 0cc451a1f3e07a3d81efbbceb4e84504
SHA1 8b5806379278bf1ff4399ec296f3398f98d4c639
SHA512 3bb523db2e42abfba3db6cc771dc6247b3b770e9a6d7f904d62b1a199f083cae100aafad558b78887276c2ddc09783d92b85cbd1f6e529d926caaf0cda797660
TLSH
T14F31449A13731FF3CBA4A7B264F75C9A32F7DA9D1947AFCB01C85238CB063245159064
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f5fea798dfb1a9890ec8b2088e2c7d58c15b89ab8410cb660d97a5b458d2a07a
MD5 1753fcca567eda41f71541c4473c207f
SHA1 eff45f994d95de17da0bb467980d34a619ff1bdf
SHA512 1b0d0504b264d9e40bbb8fceb3e4b0385ad8a0f0b4f87785985b04b422c67541a514614f9cf534318b502ba0f21184efd20198822874ff6137f9e89efba33578
SSDEEP 192:DG2qjVCjhnDR1ANGyFjPH5gcKlNfN9LNuFioI8zSU6ckWLsLIz:DxqjVC5DR1ANGyFjPH5gcKlNfN9LNuFr
TLSH
T193D1BBF783B545BD8B21A9F0AA146E1F8E5C081303BC799689E07E1763B64B1F150B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 40f391cca0525e337f7ad33926112588713810c76db1fd502056d3e5aa403f59
MD5 8bfe224867102c200c4c4a74279eac7e
SHA1 378da837560be7751f90428f993be8bf6b814e84
SHA512 64c5d42c638bdc9e351569fa4f840c0e759b3ea33186944b09d25f1ce74ffb5e23c61f8086a878fd5ee6759f71546222df21e0e7fdd0b80454cb738b2bd83059
SSDEEP 192:sxRtRoCj/f4sNXz3At4zoA8pSt/g6+WNo+F/SUL7QyUvCsHgZFLsKGsIgVyJ:sxRtBj/f4sNXzU2/57/dR7nk
TLSH
T1B442C75A6928997B4CC7D21DFA15BB67E3F91032E1941E44FAFC870C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e80d2f2705fdd286460877a4951ae7fdebf9a0f590224fa15d2acbf4a99d18c9
MD5 474431ed069d34a28196775ae3ed9c91
SHA1 72a938322fcc9ada6b8c7b65426a375523b9ce5d
SHA512 4067e6e21acf33aeda7f2173c74b175ad68d222ec3cb06f3dc491b01ccbc7669adbc3d50d5b88044ed1f5f017ebebcf0aa40777004d00d1f7fa3e0556189e275
SSDEEP 192:sxRORoCj/f4s/XA1ZY5uXIzoA8pSt/g6+WNo+F/SUL7QyUvCsHgZFL0KGsIgDVyJ:sxROBj/f4s/XA7o42/57/dR7/I
TLSH
T13952D75AA924597B4CC7D21DFA15BB67E2F91032E1901E84FAFC8B0C04EB6DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0814a626d0668ddcdccfacac48a18fb9102a95881933481655e3dc11b5e7e51a
MD5 1f8fbb40156b0297f7570e94c82e1ab7
SHA1 613769ddc6d5a9c7c18f4ebf3a5bae2a3e716762
SHA512 8c75a633b139a6765bd014512d225a17fa8083bef68e8a40fd2d2297e6396edc806794987312105b1a8828f1c043d07bbc2f0913c8ad12193265d908f2e72630
SSDEEP 192:sxRORoCj/f4s/Xz3At4zoA8pSt/g6+WNo+F/SUL7QyUvCsHgZFLsKGsIgDXyJ:sxROBj/f4s/XzU2/57/dR7ni
TLSH
T13442D75A6928997B4CC7D21DFA15BB67E3F91032E1941E84FAFC870C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 57f328acc7985512c4eaa3eea6d85a68886749a463c54af07ef023c44df71970
MD5 00036b3946a152fd4afafc0fa55b416b
SHA1 32884fc025151151c077d03a3ab2e98ec87991c1
SHA512 0dd2303643febe6e9770cd85174374712c28eea51893d20b80a2ac645e5ec4f39a0b76eef04a639269842e7c235d96729e9cd0df9206e93dc9beaf66cfb37d78
SSDEEP 768:K80E667pLuL7FwWgNhfRN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhwLWdroL6/NH:K80E6SE7FwWgNhfRNu1jaegWWLONH
TLSH
T1CFC2D97B740CCA7E4F804ADDAC197E9B6DA802CB96D8CD8047FE855C03C6BEA51154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac5b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac5b3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a267603f63701153f6d463786566e2bd146634dc55152fcb4680b3ecc25d5574
MD5 540004f13fa2b5fdee4f8a4d2ee0f5f7
SHA1 dcb2d6edd445f06836736535481680d62c118e37
SHA512 5e5cacb079c49d5e6cf53daa03033332b415b7475518fd239b8cca14442b8a806b2d640734576e9dd5b44b9cb527c9a0baf9e5e3d103b60a56e7292d3ac95e68
SSDEEP 768:ow3fci+LeSFOUubZbgtrX4fouOToPvB2thtA9VAglb9MX:ow3dlKsnnwthttYb+X
TLSH
T173F2C071A8A9CD73DDE9E358721A32862FF0517355D41FC4AEED970D0543AAE0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c62428fb7e05744fbca9a03c2df3df2fd11ba2031f932d32b5f9c2e80a9e6eb
MD5 2bef70def9a2192c06c71f75e11b61a5
SHA1 13f6273ea9810c69b1a3f16a00059024c14fc219
SHA512 1be7904ea3cb110474a83ccc446e27251052920bdfa3e62fb8c3650e6ddbdbe0c43cc4fe118befc5e44fccf2253470a7a996a2ab42ad82b2a2c3cc5984ef5de8
SSDEEP 768:Mrv+4UNbdX3fci+LeSFOUubZbgthX4fouOToPvB2thtA9VAglR:Mbsb53dl2snnwthttYR
TLSH
T16B03AE72A46D8D73DDE6E298B20B76833FF4116359C00F84EAE96B4D054B99A1B0FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e2263142ee4e7a941e38a829534ddad4e4534f002a866f3c05e91c2584f9b580
MD5 9f2510baa94037f483acf8799a7618fb
SHA1 dddf8e18008ba689ca9381fb3344c1919a49e4aa
SHA512 f824c9122139ce37e1aeae4085f21c328b2e9a7f36264c4e2c7af353e30d1d8e409ccf055e0fae16cf8fbe2957b976bdecbb54b24a4e5cc630ab1b3400208d2c
SSDEEP 768:8w3Sii+LeSFOUubZbgtvX4fouOToPvB2thtA9VAglb9MX:8w3elmsnnwthttYb+X
TLSH
T1F6F2C071A8A98D73DDD9E358720A32872FF0517395D41FC4AEED970D0543A9E0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f2830fd8398b994ccfe4cbb67b1721ca923d999516d5646fcd3b4af55a111aa3
MD5 5296b191e56a96d969dbdd9d478bf7b9
SHA1 9a001bbe6460602d54a6dd60766a7e82b953570a
SHA512 ff60fa142610b45564001c19d8f768f476ba5816ebff65b3201f525e5d81001e8fea3f6a14b2f27c13acf743b4a9cb5ee0f658daf973fdf163276c13116f8303
SSDEEP 768:grv+4UNbdH3bj+LeSFOUubpX4fouOToPvB2thtA9VAwOeVH1SlX:gbsbh3T1snnwthttnEH1Y
TLSH
T10503CF32A8AC8933DDE6D388320B72572FF4516396900FC499DD2B4D069B9DE470BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d34f1af6c94a3dcd3cb066a69e5aceb97062e163c80586f4d3148d0ecd5830e3
MD5 1c911b6352b4d78aab0daa812a22d3d9
SHA1 444c03fabe9c8618b858c39d2950e289f0068820
SHA512 5510da6d5f3cc0a1d9758ebf95b5fc4651c6a42d83510afb7b846e21f38621ca9b5681d336974f1a35c1e9a836a2a4337bfebdd085423c62a538b0891d7fb930
SSDEEP 768:LFQF32wg1irE1OUubZbgtvX4fouOToPvB2thtA9VAglb9MX:eF3PlesnnwthttYb+X
TLSH
T19D03AE72D899CE37EDE6D795B3097686AEE0517386D85EC4EAD85F0C00835DE0B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

e96c5dec-8e60-4db4-9b09-88aa59d02914.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e96c5dec-8e60-4db4-9b09-88aa59d02914.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

crhuos.exe

Path C:\Users\Admin\AppData\Local\Temp\crhuos.exe
Size 1.5MB
SHA256 b8d4672bf06fd76d7589aad93c1658dd96862d693cd8dfc584715a1e3c215517
MD5 226a6977d9c94fd7d2ae5fc96237718d
SHA1 a7676b2db6a26fbba141e486c4ee5ab36e6cb4c1
SHA512 fa4194810c9dbbe1de35b1d42fa90a5eeadeb4999edf7cfddb101a72d482ff04fe4dad570aeaaf28b3ca8e6f495f24d630a8e11fbcd96d496477359a2d216294
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdO:01/kjtPlERDGnlRANRdO
TLSH
T126757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldsajdklsajdlkjsalkda.bat

Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
Size 589B
SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
MD5 8d429a42926ee993fd964b694d838812
SHA1 39695db3362a18889277c80871a511029ca62ef2
SHA512 f6979caaf41cbe5b5ee1e6fd5fce7027ba6102470cd13bdfe3b3aaf441539b158f626c3b990567cf8a82dcb129dcc718f9408830280b793f995de89bddafe322
TLSH
T113F0F4A1168D523FC2D2F631205072A8ED8A52D3C8B39D68F5A88E5021DF58A102A1C1
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5828_988621193\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

011647.exe

Path C:\Users\Admin\AppData\Roaming\Download\011647.exe
Size 1.5MB
SHA256 e4f72922548113c983296513c33ab4e46eb04dd85c454f93847b598ee5b64637
MD5 88e7d47580f83161d3542be6db4006fc
SHA1 5ace5a5b2f7cea19b08c98cc0be657ca46da5e2e
SHA512 3cb5eb319a13f10cee24a21f9fc7b3933a05135dd143ba06a0298c81feb0ea7d758d5bfe6dc8dd719193d8bedc947bace0f79da8aeae0295d968602022b00d5f
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdV:01/kjtPlERDGnlRANRdV
TLSH
T106757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

084545.exe

Path C:\Users\Admin\AppData\Roaming\Download\084545.exe
Size 1.5MB
SHA256 9fcc5230e65fe7acff5a39a57f9765d2591c8037ec938a25dd6e6355f49288e8
MD5 fa1a0944411bd9ba6b94f94da90303c0
SHA1 64ac3f2f2ce55790ed25ccd4528d9d645d2c0b5c
SHA512 b46ea1d9befbce32dc84632d47a659e6ec9f23280069202bbfaa120abbcd0d2572f16dabaa51700602f3e1f11a385aaa5fb942ecea8c4bdfb1f6dcf7a7adbabb
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdN:01/kjtPlERDGnlRANRdN
TLSH
T145757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

186947.exe

Path C:\Users\Admin\AppData\Roaming\Download\186947.exe
Size 1.5MB
SHA256 6d1ca31720bc356c03530df996763088eaea8151fdc3bef8b3998f98b084b21f
MD5 0c46b3ffda5ed1c5c2fc7728de2c27f4
SHA1 c73ea4e291ad4c8ac68940cb3e3172800cf14578
SHA512 dfcf9df9229dad61877ca166a504ce4e1f077f2d58bc236a66d6b3eda238e6ef7a452f3513832e94234b62bc9075ee48a9cedacbd92f4b7c5c29a02959c535f0
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdO:01/kjtPlERDGnlRANRdO
TLSH
T179757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

378089.exe

Path C:\Users\Admin\AppData\Roaming\Download\378089.exe
Size 1.5MB
SHA256 84bba346c36c51273d3387c7185e333ba11dbb5947f7acdc62bc5c85fe18716c
MD5 35c5004213b44ee1218db7c42d378759
SHA1 e3ad5a78710a9314490cb0d68bcd0d86efe61370
SHA512 b384d21327250667ac9942c3ee1556b6d871a75a825a541af4077f7b4dbe092d11b03e14d0207cfdff2448822123bf6e331c3188761f451aeb5820d054817bd5
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdc:01/kjtPlERDGnlRANRdc
TLSH
T1BD757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

425316.exe

Path C:\Users\Admin\AppData\Roaming\Download\425316.exe
Size 1.5MB
SHA256 0c7d9243adb2adc2d84e6e8fae7ed11b4296db070f9c704a618b37acbcf4d384
MD5 f4437a27358569a2c8c6314c7a71f312
SHA1 f75c74ede832f6d8992489ace723b23bf1cca136
SHA512 61fc297755e475e37c2da2785899d4d9be6bf6a80c375d657b9b11b0068d9154646a5d3b256df541b4caa53d4747ee0d50a9a96f721fa318f40fcc872771bfbd
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdo:01/kjtPlERDGnlRANRdo
TLSH
T112757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

545304.exe

Path C:\Users\Admin\AppData\Roaming\Download\545304.exe
Size 1.5MB
SHA256 f3df8d0bd4b8e267fef4053771717b300a1244508a3747e3030e6afb195de943
MD5 b41642fd487501717c6932fa8b9d13bc
SHA1 1e044965a86fa5e0b7b9bdc81f26bdeeb67b33aa
SHA512 f4db53ccbfa002dc3629c187bdfcde6eb44c6936ab625eaefaa1c9c5639df16b30fb46381853e7d9a23047046a03a4b11ee8f15a6bce3b91e32a75c98ddec311
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRd5:01/kjtPlERDGnlRANRd5
TLSH
T1D4757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640906.exe

Path C:\Users\Admin\AppData\Roaming\Download\640906.exe
Size 1.5MB
SHA256 1c54be669d33c7126055d8260fff44675d98189972da081b2a9a065f7c06a076
MD5 4a9e8182aeab8f283ad03db06a8506a7
SHA1 8fe2ef99d6207b1b29db38cf92ba966046f5acac
SHA512 ffeebe0729ca59bb57b4e5c779c1adc0f38229cb80c1d150c39af2505461aa5282370e24ee91c629af7d12c776177909789cd82e9075bbe0c07962d897bd604b
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdp:01/kjtPlERDGnlRANRdp
TLSH
T16B757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

689063.exe

Path C:\Users\Admin\AppData\Roaming\Download\689063.exe
Size 1.5MB
SHA256 f37255b1deda39a2d16b741b256206ad453d7dc831fa7e0c6acb31a942bd2372
MD5 0fd9a4b450cf646e9fc48335758b41c5
SHA1 cb73f2215bf28839bacd1b4c7733d9d8820cad1d
SHA512 b8c7c8b2d41cb4197b996d98730a8e737f114b3365ab3fc96c57c104183b3ad79203ec13c793ab4f541126637f761a27d15c77cf8f84eb5b15fa3ddfbb0ddd90
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdo:01/kjtPlERDGnlRANRdo
TLSH
T19D757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773955.exe

Path C:\Users\Admin\AppData\Roaming\Download\773955.exe
Size 1.5MB
SHA256 a3bfb8f819e19efc18a2fa4c8bf24228bc486f0786901416260975f93f503285
MD5 1654c4c8192b490b5eeaebb7b927212b
SHA1 a2c3e86aa5aeb9749a33d6c60a9bc48a2e98560d
SHA512 dd82f7cf0b29c9525ca7cb2596161cfbd58782c7a9c1297f2034d1cb8616df02ae3f19d0442eeb7cf821b98b1c027ad4d6027d64d0bc6431f4ae11f98eec1d8b
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRd4:01/kjtPlERDGnlRANRd4
TLSH
T1DD757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

830501.exe

Path C:\Users\Admin\AppData\Roaming\Download\830501.exe
Size 1.5MB
SHA256 e0f4e48226cbc7364337f6fdee710ccf6fd469673829ad79b9a4374144ed6a45
MD5 c34db61db3dd1fe84313bcde837128a0
SHA1 8c8c58760b9993176e6a38c2026242275601cdbe
SHA512 4197fec542e8b9189c45535537fb39cdf419fc24ecbd519c1d1927ac4380da520d5ef200971366202f51088a343cdc8b4f820749430046797defc591bb359727
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdq:01/kjtPlERDGnlRANRdq
TLSH
T192757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

866122.exe

Path C:\Users\Admin\AppData\Roaming\Download\866122.exe
Size 1.5MB
SHA256 31786fe56cd616a332eed84640b25b20438b8291867f81c1b54186da82ab5667
MD5 56a75e4bc8e46a88624c214fba6e0ba6
SHA1 183a881984708bca950f050d7591e6acb35c2632
SHA512 22cfa2691b17d1e9cdb85edbab9403b38039dd40c3c504247ffcc6b77b4d12d200b4e9446c12063b87056f7b5c1d3302f29a9e5fb5fc4970aadb4dbd3b75d117
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdZ:01/kjtPlERDGnlRANRdZ
TLSH
T10B757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

923798.exe

Path C:\Users\Admin\AppData\Roaming\Download\923798.exe
Size 1.5MB
SHA256 6c4149a315e7a8ccc74205f21d5bea77fb5eca85e1500bb5227b621e887a11c1
MD5 28d44891e529adcf51d20293bfd41254
SHA1 a3ca6b5c15cf2ab4aedd62867596f3828057c726
SHA512 e20aaaaa26a2e29d753d2cac5989acf5f24ccead0525d7deab7f1da4f8b12266f32353196e5d9f30c3bd5513746057639167be0bdd734ac11237f11b464b0540
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdS:01/kjtPlERDGnlRANRdS
TLSH
T195757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

945163.exe

Path C:\Users\Admin\AppData\Roaming\Download\945163.exe
Size 1.5MB
SHA256 4246362a0e2b578b48a16eaf6983e94ca3e42044d8cf48d7a21dff4efc55e1c9
MD5 c792719e1670cce305c15cbb08753988
SHA1 86e691f9b173bd4372c694187c7a2c188aaeb53c
SHA512 68e07934dcd141aedbac55fb629ede01a505c69867f1e2787db64fcd71de7c32d48140f68e8234a9d1b86f3ce38697fe9fce373b45c964ae9a08c3690da1d593
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdT:01/kjtPlERDGnlRANRdT
TLSH
T1D6757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4840-108-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-756-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-161-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-667-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-708-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-609-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-283-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-800-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-513-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-846-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-877-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-913-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5540-442-0x0000000000400000-0x000000000059A000-memory.dmp

Download