Overview

overview

7

Static

static

3

2026-08-06...op.exe

windows10-2004-x64

7

2026-08-06...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    127s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 16:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_f212c2c97bf47988bb1c95ca55482bdc_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260806-t7syfaba48
  • SHA256 0339bf69cc8f7e9cee659f225a96dd25ef0a0685d7f0e129e939889f54314d59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_f212c2c97bf47988bb1c95ca55482bdc_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_f212c2c97bf47988bb1c95ca55482bdc_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Users\Admin\AppData\Local\Temp\pswqyx.exe
      "C:\Users\Admin\AppData\Local\Temp\pswqyx.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Users\Admin\AppData\Local\Temp\pswqyx.exe
        "C:\Users\Admin\AppData\Local\Temp\pswqyx.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5876
        • C:\Users\Admin\AppData\Roaming\Download\501886.exe
          "C:\Users\Admin\AppData\Roaming\Download\501886.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Users\Admin\AppData\Roaming\Download\501886.exe
            "C:\Users\Admin\AppData\Roaming\Download\501886.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4520
        • C:\Users\Admin\AppData\Roaming\Download\501471.exe
          "C:\Users\Admin\AppData\Roaming\Download\501471.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1212
          • C:\Users\Admin\AppData\Roaming\Download\501471.exe
            "C:\Users\Admin\AppData\Roaming\Download\501471.exe"
            5⤵
            • Executes dropped EXE
            PID:920
        • C:\Users\Admin\AppData\Roaming\Download\564254.exe
          "C:\Users\Admin\AppData\Roaming\Download\564254.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5920
          • C:\Users\Admin\AppData\Roaming\Download\564254.exe
            "C:\Users\Admin\AppData\Roaming\Download\564254.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1584
        • C:\Users\Admin\AppData\Roaming\Download\336132.exe
          "C:\Users\Admin\AppData\Roaming\Download\336132.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5484
          • C:\Users\Admin\AppData\Roaming\Download\336132.exe
            "C:\Users\Admin\AppData\Roaming\Download\336132.exe"
            5⤵
            • Executes dropped EXE
            PID:1900
        • C:\Users\Admin\AppData\Roaming\Download\799835.exe
          "C:\Users\Admin\AppData\Roaming\Download\799835.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5840
          • C:\Users\Admin\AppData\Roaming\Download\799835.exe
            "C:\Users\Admin\AppData\Roaming\Download\799835.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4924
        • C:\Users\Admin\AppData\Roaming\Download\532271.exe
          "C:\Users\Admin\AppData\Roaming\Download\532271.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Users\Admin\AppData\Roaming\Download\532271.exe
            "C:\Users\Admin\AppData\Roaming\Download\532271.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4452
        • C:\Users\Admin\AppData\Roaming\Download\881070.exe
          "C:\Users\Admin\AppData\Roaming\Download\881070.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Users\Admin\AppData\Roaming\Download\881070.exe
            "C:\Users\Admin\AppData\Roaming\Download\881070.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1648
        • C:\Users\Admin\AppData\Roaming\Download\631938.exe
          "C:\Users\Admin\AppData\Roaming\Download\631938.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1380
          • C:\Users\Admin\AppData\Roaming\Download\631938.exe
            "C:\Users\Admin\AppData\Roaming\Download\631938.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5244
        • C:\Users\Admin\AppData\Roaming\Download\701115.exe
          "C:\Users\Admin\AppData\Roaming\Download\701115.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1768
          • C:\Users\Admin\AppData\Roaming\Download\701115.exe
            "C:\Users\Admin\AppData\Roaming\Download\701115.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1940
        • C:\Users\Admin\AppData\Roaming\Download\321311.exe
          "C:\Users\Admin\AppData\Roaming\Download\321311.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2068
          • C:\Users\Admin\AppData\Roaming\Download\321311.exe
            "C:\Users\Admin\AppData\Roaming\Download\321311.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:440
        • C:\Users\Admin\AppData\Roaming\Download\825820.exe
          "C:\Users\Admin\AppData\Roaming\Download\825820.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2952
          • C:\Users\Admin\AppData\Roaming\Download\825820.exe
            "C:\Users\Admin\AppData\Roaming\Download\825820.exe"
            5⤵
            • Executes dropped EXE
            PID:4268
        • C:\Users\Admin\AppData\Roaming\Download\526451.exe
          "C:\Users\Admin\AppData\Roaming\Download\526451.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3948
          • C:\Users\Admin\AppData\Roaming\Download\526451.exe
            "C:\Users\Admin\AppData\Roaming\Download\526451.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6096
        • C:\Users\Admin\AppData\Roaming\Download\920980.exe
          "C:\Users\Admin\AppData\Roaming\Download\920980.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2784
          • C:\Users\Admin\AppData\Roaming\Download\920980.exe
            "C:\Users\Admin\AppData\Roaming\Download\920980.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4536
        • C:\Users\Admin\AppData\Roaming\Download\166942.exe
          "C:\Users\Admin\AppData\Roaming\Download\166942.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1864
          • C:\Users\Admin\AppData\Roaming\Download\166942.exe
            "C:\Users\Admin\AppData\Roaming\Download\166942.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4148
        • C:\Users\Admin\AppData\Roaming\Download\767656.exe
          "C:\Users\Admin\AppData\Roaming\Download\767656.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5244
          • C:\Users\Admin\AppData\Roaming\Download\767656.exe
            "C:\Users\Admin\AppData\Roaming\Download\767656.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1736
        • C:\Users\Admin\AppData\Roaming\Download\916454.exe
          "C:\Users\Admin\AppData\Roaming\Download\916454.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3408
          • C:\Users\Admin\AppData\Roaming\Download\916454.exe
            "C:\Users\Admin\AppData\Roaming\Download\916454.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2136
        • C:\Users\Admin\AppData\Roaming\Download\559899.exe
          "C:\Users\Admin\AppData\Roaming\Download\559899.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1656
          • C:\Users\Admin\AppData\Roaming\Download\559899.exe
            "C:\Users\Admin\AppData\Roaming\Download\559899.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4688
        • C:\Users\Admin\AppData\Roaming\Download\843167.exe
          "C:\Users\Admin\AppData\Roaming\Download\843167.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2076
          • C:\Users\Admin\AppData\Roaming\Download\843167.exe
            "C:\Users\Admin\AppData\Roaming\Download\843167.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1900
        • C:\Users\Admin\AppData\Roaming\Download\134859.exe
          "C:\Users\Admin\AppData\Roaming\Download\134859.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1340
          • C:\Users\Admin\AppData\Roaming\Download\134859.exe
            "C:\Users\Admin\AppData\Roaming\Download\134859.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1788
        • C:\Users\Admin\AppData\Roaming\Download\534473.exe
          "C:\Users\Admin\AppData\Roaming\Download\534473.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2532
          • C:\Users\Admin\AppData\Roaming\Download\534473.exe
            "C:\Users\Admin\AppData\Roaming\Download\534473.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3184
        • C:\Users\Admin\AppData\Roaming\Download\883363.exe
          "C:\Users\Admin\AppData\Roaming\Download\883363.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2860
          • C:\Users\Admin\AppData\Roaming\Download\883363.exe
            "C:\Users\Admin\AppData\Roaming\Download\883363.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3532
        • C:\Users\Admin\AppData\Roaming\Download\484085.exe
          "C:\Users\Admin\AppData\Roaming\Download\484085.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3628
          • C:\Users\Admin\AppData\Roaming\Download\484085.exe
            "C:\Users\Admin\AppData\Roaming\Download\484085.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5952
        • C:\Users\Admin\AppData\Roaming\Download\772699.exe
          "C:\Users\Admin\AppData\Roaming\Download\772699.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5940
          • C:\Users\Admin\AppData\Roaming\Download\772699.exe
            "C:\Users\Admin\AppData\Roaming\Download\772699.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3012
        • C:\Users\Admin\AppData\Roaming\Download\908672.exe
          "C:\Users\Admin\AppData\Roaming\Download\908672.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3192
          • C:\Users\Admin\AppData\Roaming\Download\908672.exe
            "C:\Users\Admin\AppData\Roaming\Download\908672.exe"
            5⤵
            • Executes dropped EXE
            PID:5000
        • C:\Users\Admin\AppData\Roaming\Download\867812.exe
          "C:\Users\Admin\AppData\Roaming\Download\867812.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3044
          • C:\Users\Admin\AppData\Roaming\Download\867812.exe
            "C:\Users\Admin\AppData\Roaming\Download\867812.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:120
        • C:\Users\Admin\AppData\Roaming\Download\851080.exe
          "C:\Users\Admin\AppData\Roaming\Download\851080.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3756
          • C:\Users\Admin\AppData\Roaming\Download\851080.exe
            "C:\Users\Admin\AppData\Roaming\Download\851080.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3376
        • C:\Users\Admin\AppData\Roaming\Download\494426.exe
          "C:\Users\Admin\AppData\Roaming\Download\494426.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5208
          • C:\Users\Admin\AppData\Roaming\Download\494426.exe
            "C:\Users\Admin\AppData\Roaming\Download\494426.exe"
            5⤵
            • Executes dropped EXE
            PID:3940
        • C:\Users\Admin\AppData\Roaming\Download\953223.exe
          "C:\Users\Admin\AppData\Roaming\Download\953223.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:4240
          • C:\Users\Admin\AppData\Roaming\Download\953223.exe
            "C:\Users\Admin\AppData\Roaming\Download\953223.exe"
            5⤵
            • Executes dropped EXE
            PID:1468
        • C:\Users\Admin\AppData\Roaming\Download\979183.exe
          "C:\Users\Admin\AppData\Roaming\Download\979183.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2724
          • C:\Users\Admin\AppData\Roaming\Download\979183.exe
            "C:\Users\Admin\AppData\Roaming\Download\979183.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5464
        • C:\Users\Admin\AppData\Roaming\Download\228981.exe
          "C:\Users\Admin\AppData\Roaming\Download\228981.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:120
          • C:\Users\Admin\AppData\Roaming\Download\228981.exe
            "C:\Users\Admin\AppData\Roaming\Download\228981.exe"
            5⤵
            • Executes dropped EXE
            PID:4544
        • C:\Users\Admin\AppData\Roaming\Download\176023.exe
          "C:\Users\Admin\AppData\Roaming\Download\176023.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3744
          • C:\Users\Admin\AppData\Roaming\Download\176023.exe
            "C:\Users\Admin\AppData\Roaming\Download\176023.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5524
        • C:\Users\Admin\AppData\Roaming\Download\159825.exe
          "C:\Users\Admin\AppData\Roaming\Download\159825.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5148
          • C:\Users\Admin\AppData\Roaming\Download\159825.exe
            "C:\Users\Admin\AppData\Roaming\Download\159825.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1104
        • C:\Users\Admin\AppData\Roaming\Download\377330.exe
          "C:\Users\Admin\AppData\Roaming\Download\377330.exe" /Shorttailedrestart
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4484
          • C:\Users\Admin\AppData\Roaming\Download\377330.exe
            "C:\Users\Admin\AppData\Roaming\Download\377330.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4540
        • C:\Users\Admin\AppData\Roaming\Download\079861.exe
          "C:\Users\Admin\AppData\Roaming\Download\079861.exe" /Shorttailedrestart
          4⤵
            PID:2788
            • C:\Users\Admin\AppData\Roaming\Download\079861.exe
              "C:\Users\Admin\AppData\Roaming\Download\079861.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4328
          • C:\Users\Admin\AppData\Roaming\Download\573470.exe
            "C:\Users\Admin\AppData\Roaming\Download\573470.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4768
            • C:\Users\Admin\AppData\Roaming\Download\573470.exe
              "C:\Users\Admin\AppData\Roaming\Download\573470.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5128
          • C:\Users\Admin\AppData\Roaming\Download\323357.exe
            "C:\Users\Admin\AppData\Roaming\Download\323357.exe" /Shorttailedrestart
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4548
            • C:\Users\Admin\AppData\Roaming\Download\323357.exe
              "C:\Users\Admin\AppData\Roaming\Download\323357.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5880
          • C:\Users\Admin\AppData\Roaming\Download\985053.exe
            "C:\Users\Admin\AppData\Roaming\Download\985053.exe" /Shorttailedrestart
            4⤵
              PID:2268
              • C:\Users\Admin\AppData\Roaming\Download\985053.exe
                "C:\Users\Admin\AppData\Roaming\Download\985053.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:936
            • C:\Users\Admin\AppData\Roaming\Download\642214.exe
              "C:\Users\Admin\AppData\Roaming\Download\642214.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3292
              • C:\Users\Admin\AppData\Roaming\Download\642214.exe
                "C:\Users\Admin\AppData\Roaming\Download\642214.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5136
            • C:\Users\Admin\AppData\Roaming\Download\746902.exe
              "C:\Users\Admin\AppData\Roaming\Download\746902.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5156
              • C:\Users\Admin\AppData\Roaming\Download\746902.exe
                "C:\Users\Admin\AppData\Roaming\Download\746902.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3496
            • C:\Users\Admin\AppData\Roaming\Download\309626.exe
              "C:\Users\Admin\AppData\Roaming\Download\309626.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2272
              • C:\Users\Admin\AppData\Roaming\Download\309626.exe
                "C:\Users\Admin\AppData\Roaming\Download\309626.exe"
                5⤵
                  PID:2480
              • C:\Users\Admin\AppData\Roaming\Download\944962.exe
                "C:\Users\Admin\AppData\Roaming\Download\944962.exe" /Shorttailedrestart
                4⤵
                  PID:5564
                  • C:\Users\Admin\AppData\Roaming\Download\944962.exe
                    "C:\Users\Admin\AppData\Roaming\Download\944962.exe"
                    5⤵
                      PID:4268
                  • C:\Users\Admin\AppData\Roaming\Download\193849.exe
                    "C:\Users\Admin\AppData\Roaming\Download\193849.exe" /Shorttailedrestart
                    4⤵
                      PID:2388
                      • C:\Users\Admin\AppData\Roaming\Download\193849.exe
                        "C:\Users\Admin\AppData\Roaming\Download\193849.exe"
                        5⤵
                          PID:3376
                      • C:\Users\Admin\AppData\Roaming\Download\452649.exe
                        "C:\Users\Admin\AppData\Roaming\Download\452649.exe" /Shorttailedrestart
                        4⤵
                          PID:2084
                          • C:\Users\Admin\AppData\Roaming\Download\452649.exe
                            "C:\Users\Admin\AppData\Roaming\Download\452649.exe"
                            5⤵
                              PID:716
                          • C:\Users\Admin\AppData\Roaming\Download\453244.exe
                            "C:\Users\Admin\AppData\Roaming\Download\453244.exe" /Shorttailedrestart
                            4⤵
                              PID:5304
                              • C:\Users\Admin\AppData\Roaming\Download\453244.exe
                                "C:\Users\Admin\AppData\Roaming\Download\453244.exe"
                                5⤵
                                  PID:1284
                              • C:\Users\Admin\AppData\Roaming\Download\823938.exe
                                "C:\Users\Admin\AppData\Roaming\Download\823938.exe" /Shorttailedrestart
                                4⤵
                                  PID:3240
                                  • C:\Users\Admin\AppData\Roaming\Download\823938.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\823938.exe"
                                    5⤵
                                      PID:4284
                                  • C:\Users\Admin\AppData\Roaming\Download\487372.exe
                                    "C:\Users\Admin\AppData\Roaming\Download\487372.exe" /Shorttailedrestart
                                    4⤵
                                      PID:4940
                                      • C:\Users\Admin\AppData\Roaming\Download\487372.exe
                                        "C:\Users\Admin\AppData\Roaming\Download\487372.exe"
                                        5⤵
                                          PID:6024
                                      • C:\Users\Admin\AppData\Roaming\Download\049098.exe
                                        "C:\Users\Admin\AppData\Roaming\Download\049098.exe" /Shorttailedrestart
                                        4⤵
                                          PID:1360
                                          • C:\Users\Admin\AppData\Roaming\Download\049098.exe
                                            "C:\Users\Admin\AppData\Roaming\Download\049098.exe"
                                            5⤵
                                              PID:3308
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                        2⤵
                                        • Drops file in Windows directory
                                        • Enumerates system info in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of WriteProcessMemory
                                        PID:4408
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7fffa455c188,0x7fffa455c194,0x7fffa455c1a0
                                          3⤵
                                            PID:3344
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6039079266411970815,1536053327035053400,262144 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
                                            3⤵
                                              PID:1376
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11757254754709706497,6646974118365134894,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
                                              3⤵
                                              • System Time Discovery
                                              PID:5904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,6332200972285719560,18332810777688968553,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
                                              3⤵
                                                PID:4900
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12672987268364055583,4050876221800357744,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                                                3⤵
                                                  PID:1296
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,1703477896840824743,14686657330159026397,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
                                                  3⤵
                                                    PID:4132
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,13818522854152309560,6686749176122961058,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
                                                    3⤵
                                                      PID:5616
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14554234186728257538,150281954180624409,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
                                                      3⤵
                                                        PID:1660
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,15142742769336156254,15735559375381894284,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
                                                        3⤵
                                                          PID:5572
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4321187991412393598,9299120892494477268,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
                                                          3⤵
                                                            PID:4620
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14230392420517463835,15891334298162603919,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
                                                            3⤵
                                                              PID:2120
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1493808984451474537,9595884994065192969,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                                              3⤵
                                                                PID:2620
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1493808984451474537,9595884994065192969,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                                                3⤵
                                                                  PID:1260
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13464954225472195979,11220694481672364788,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                                                  3⤵
                                                                    PID:1768
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14259090917605086917,9851117263279219333,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
                                                                    3⤵
                                                                      PID:1640
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8128223508903060152,13626935466377535823,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                                                      3⤵
                                                                        PID:3288
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,9464276846415043327,7239248599905943356,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                                        3⤵
                                                                          PID:5160
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6360,i,7347360279397549446,15927157066992219663,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
                                                                          3⤵
                                                                            PID:564
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3712,i,3681246956594955951,17810579142381738464,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
                                                                            3⤵
                                                                              PID:3088
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6676,i,11023812326753283395,11843679792626564598,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
                                                                              3⤵
                                                                                PID:1596
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,4789898982952595545,4546314810376120946,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:12
                                                                                3⤵
                                                                                  PID:2228
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17155151081997797068,5733751100466446908,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                                                  3⤵
                                                                                  • Modifies registry class
                                                                                  PID:1640
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5052,i,5169694213795901057,5117525536491897915,2097152 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
                                                                                  3⤵
                                                                                    PID:2220
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11628864131274533560,5645421001384205011,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
                                                                                    3⤵
                                                                                      PID:204
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6477735915616229985,17119269345740061562,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                                                                      3⤵
                                                                                        PID:4964
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,11566928572201344738,14425817100565905307,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
                                                                                        3⤵
                                                                                          PID:3408
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,13434709561635707721,13966404616614042057,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
                                                                                          3⤵
                                                                                            PID:5412
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,833914056854019211,11695546756686086707,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
                                                                                            3⤵
                                                                                              PID:3532
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,9514755890268131992,12071980401998056764,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
                                                                                              3⤵
                                                                                                PID:856
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,5217576088206790443,8263914738767687309,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:3304
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,9850193988764973844,1870296648063571708,262144 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:10
                                                                                                  3⤵
                                                                                                    PID:1112
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,6014322010728288906,17178508254163768111,524288 --field-trial-handle=2284,i,8765015155906052044,13242923381511239238,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
                                                                                                    3⤵
                                                                                                      PID:1624
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                    2⤵
                                                                                                      PID:108
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2200
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                      2⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:4684
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:3152
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                      1⤵
                                                                                                        PID:904

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            DouTuDaShi.exe
                                                                                                            • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                            • Size 1.1MB
                                                                                                            • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            blocklist
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                            • Size 105KB
                                                                                                            • SHA256 f23fde02e6abf8cd0305ab90615b1755e3aeb27a3f4cbd6fc54416037b890ff8
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            settings.dat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            • Size 280B
                                                                                                            • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            settings.dat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            • Size 280B
                                                                                                            • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            340cdba3-1cb0-4102-b256-472f6a78d07e.tmp
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\340cdba3-1cb0-4102-b256-472f6a78d07e.tmp
                                                                                                            • Size 70KB
                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                            • Size 6B
                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            the-real-index
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                            • Size 3KB
                                                                                                            • SHA256 9ae2041d66fda6ddaeba293a98d1a5aaf461058069b655226b477cb6cf7b741a
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            the-real-index~RFe59f62e.TMP
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f62e.TMP
                                                                                                            • Size 2KB
                                                                                                            • SHA256 e1be954d2dc30c6f0208cc6483f7bb349d600e59ea3a72ad93712633b43f536f
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            SiteList-Enterprise.json
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                            • Size 2B
                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            Network Persistent State
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                            • Size 6KB
                                                                                                            • SHA256 5d3cb79d6bea58470fa7a168a9e1e210baf6f7e2434399f4def29ce6e89e892c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            SCT Auditing Pending Reports
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                            • Size 2B
                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            Sdch Dictionaries
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                            • Size 40B
                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            Preferences
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            • Size 16KB
                                                                                                            • SHA256 5fc07d1b83677c79fac48c5c6adf654884448d8a01ae8140833ca4a1bd315124
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Preferences
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            • Size 14KB
                                                                                                            • SHA256 c85750d1817f29c62393c32e7b81860bbc83237a4785c5f11eaa11435eb7bffb
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Preferences
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            • Size 15KB
                                                                                                            • SHA256 cced649c73829eb329ec7134d461c5e27d4c82a99db836ddce7eb18db67a16a2
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Secure Preferences
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                            • Size 32KB
                                                                                                            • SHA256 1b3434dbccfb7bbb9c40fb8eca0893f39ed07d600fb3fdd4b553d5248d9a6409
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            sync_diagnostic.log
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                            • Size 4KB
                                                                                                            • SHA256 851a542d0b5773fd23152436ae5558b748a4298116cd6337d7c7035403647be4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            OperationConfig
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                            • Size 22KB
                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            OperationConfig~RFe5a1acd.TMP
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1acd.TMP
                                                                                                            • Size 3KB
                                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            Local State
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            • Size 35KB
                                                                                                            • SHA256 544e3693a094f4ac7cdf84800a62c0c88131424ff9c20e598118a330a0ff2359
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Local State
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            • Size 44KB
                                                                                                            • SHA256 74b6db6d369ed889525fa72970b532929b242537600c8005ba1ec4c069dcf1d5
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Local State
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            • Size 35KB
                                                                                                            • SHA256 2571a992d7b7fecd1c0f7aea42ad8057828da703ddea00d7f2a8a4425f01c386
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Local State
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            • Size 38KB
                                                                                                            • SHA256 c2daa43ec7fa261f1c275b991bb037fd390588ee6871ef19973e3cbc28b18787
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            metadata.json
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                            • Size 252B
                                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            metadata.json
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                            • Size 372B
                                                                                                            • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            metadata.json
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                            • Size 132B
                                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                            • Size 153KB
                                                                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            f2050e55-426c-42ce-a616-d281b11489ff.tmp
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f2050e55-426c-42ce-a616-d281b11489ff.tmp
                                                                                                            • Size 13B
                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            metadata.json~RFe59576d.TMP
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59576d.TMP
                                                                                                            • Size 132B
                                                                                                            • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            952b5c75-71c5-4296-b882-728cf0cbd2e1.tmp
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\952b5c75-71c5-4296-b882-728cf0cbd2e1.tmp
                                                                                                            • Size 1B
                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            ldsajdklsajdlkjsalkda.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                            • Size 589B
                                                                                                            • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            pswqyx.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pswqyx.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 0339bf69cc8f7e9cee659f225a96dd25ef0a0685d7f0e129e939889f54314d59
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            content_new.js
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4408_102653233\CRX_INSTALL\content_new.js
                                                                                                            • Size 10KB
                                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            321311.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\321311.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 0809977e473420bff301979c5e055d53a967d40b777b041eabdf6cd335f11add
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            336132.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\336132.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 0de500696db656d2b681388019825b73ad4d11910da4a2f2ce5279b72a833f00
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            501471.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\501471.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 dbc197e23c010f6223d234b16ceb2dc94f4764239f0b531454d89ac9813e3a38
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            501886.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\501886.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 3f828936df6485f9222c076e06552241400265bc1c3b13e1a9f11a431f400fc3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            526451.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\526451.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 7a06708a394bbc88993b92a685b40aa613a1028a0d189615ae31451c8d0963da
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            532271.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\532271.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 e299267e1b99c286380816580c58fb1533f2eb4ae73a576a4f9af75b8abdc6d9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            564254.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\564254.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 b0e09d644e02be0463b64d0b59a637e7e5a1ff1144c149b19af4396544a4e3c2
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            631938.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\631938.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 901ec8397c736c5d3102750dcf3ea8f041f330e4ffd84f7edf241d6475fdb85a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            701115.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\701115.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 fcc2d39d2799407e2e073bf29115e4cbc26f7ccfbdd4822d355fa2f6e8c31998
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            799835.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\799835.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 456bacec195120e5b1864d9f4b6b56f60f4be1320670989dff6264e8fd16cfee
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            825820.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\825820.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 9af658ec924f0e5d989455fc0675adfa05e31ae6b35e3b916b8be64fa9651b1f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            881070.exe
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Download\881070.exe
                                                                                                            • Size 1.5MB
                                                                                                            • SHA256 75bc2bcae91e000f42ab665aab919e355e98d4fb000ab373b76ce606f7313e01
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            memory/3668-115-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-864-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-904-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-591-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-958-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-770-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-1003-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-1048-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-722-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-1093-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-1126-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-815-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-1181-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5876-294-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                            Download