Overview

overview

7

Static

static

3

2026-08-10...op.exe

windows10-2004-x64

7

2026-08-10...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    124s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 23:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_83782a9211faba36cc639c37515b064c_elex_emotet_icedid_krbanker_remcos_stop.exe
  • Size 1.5MB
  • Sample260810-3rperacj21
  • SHA256 30d45365fb05c82aaee5251e7b88c6d7a344b8fb4673f259a6bf70360a20fe7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_83782a9211faba36cc639c37515b064c_elex_emotet_icedid_krbanker_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_83782a9211faba36cc639c37515b064c_elex_emotet_icedid_krbanker_remcos_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2308
    • C:\Users\Admin\AppData\Local\Temp\rtxibr.exe
      "C:\Users\Admin\AppData\Local\Temp\rtxibr.exe" /jscxyxztjkl
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Users\Admin\AppData\Local\Temp\rtxibr.exe
        "C:\Users\Admin\AppData\Local\Temp\rtxibr.exe" /jsjczxztcq
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Users\Admin\AppData\Roaming\Download\841693.exe
          "C:\Users\Admin\AppData\Roaming\Download\841693.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Users\Admin\AppData\Roaming\Download\841693.exe
            "C:\Users\Admin\AppData\Roaming\Download\841693.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4608
        • C:\Users\Admin\AppData\Roaming\Download\724477.exe
          "C:\Users\Admin\AppData\Roaming\Download\724477.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:464
          • C:\Users\Admin\AppData\Roaming\Download\724477.exe
            "C:\Users\Admin\AppData\Roaming\Download\724477.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3320
        • C:\Users\Admin\AppData\Roaming\Download\186291.exe
          "C:\Users\Admin\AppData\Roaming\Download\186291.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5772
          • C:\Users\Admin\AppData\Roaming\Download\186291.exe
            "C:\Users\Admin\AppData\Roaming\Download\186291.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3272
        • C:\Users\Admin\AppData\Roaming\Download\814719.exe
          "C:\Users\Admin\AppData\Roaming\Download\814719.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5180
          • C:\Users\Admin\AppData\Roaming\Download\814719.exe
            "C:\Users\Admin\AppData\Roaming\Download\814719.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3964
        • C:\Users\Admin\AppData\Roaming\Download\117694.exe
          "C:\Users\Admin\AppData\Roaming\Download\117694.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Users\Admin\AppData\Roaming\Download\117694.exe
            "C:\Users\Admin\AppData\Roaming\Download\117694.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2816
        • C:\Users\Admin\AppData\Roaming\Download\928747.exe
          "C:\Users\Admin\AppData\Roaming\Download\928747.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\Users\Admin\AppData\Roaming\Download\928747.exe
            "C:\Users\Admin\AppData\Roaming\Download\928747.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2072
        • C:\Users\Admin\AppData\Roaming\Download\243335.exe
          "C:\Users\Admin\AppData\Roaming\Download\243335.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5512
          • C:\Users\Admin\AppData\Roaming\Download\243335.exe
            "C:\Users\Admin\AppData\Roaming\Download\243335.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2980
        • C:\Users\Admin\AppData\Roaming\Download\644964.exe
          "C:\Users\Admin\AppData\Roaming\Download\644964.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1192
          • C:\Users\Admin\AppData\Roaming\Download\644964.exe
            "C:\Users\Admin\AppData\Roaming\Download\644964.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2784
        • C:\Users\Admin\AppData\Roaming\Download\342310.exe
          "C:\Users\Admin\AppData\Roaming\Download\342310.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5076
          • C:\Users\Admin\AppData\Roaming\Download\342310.exe
            "C:\Users\Admin\AppData\Roaming\Download\342310.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1948
        • C:\Users\Admin\AppData\Roaming\Download\177547.exe
          "C:\Users\Admin\AppData\Roaming\Download\177547.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:248
          • C:\Users\Admin\AppData\Roaming\Download\177547.exe
            "C:\Users\Admin\AppData\Roaming\Download\177547.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3964
        • C:\Users\Admin\AppData\Roaming\Download\542743.exe
          "C:\Users\Admin\AppData\Roaming\Download\542743.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6096
          • C:\Users\Admin\AppData\Roaming\Download\542743.exe
            "C:\Users\Admin\AppData\Roaming\Download\542743.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4864
        • C:\Users\Admin\AppData\Roaming\Download\271895.exe
          "C:\Users\Admin\AppData\Roaming\Download\271895.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:5108
          • C:\Users\Admin\AppData\Roaming\Download\271895.exe
            "C:\Users\Admin\AppData\Roaming\Download\271895.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5036
        • C:\Users\Admin\AppData\Roaming\Download\129056.exe
          "C:\Users\Admin\AppData\Roaming\Download\129056.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3860
          • C:\Users\Admin\AppData\Roaming\Download\129056.exe
            "C:\Users\Admin\AppData\Roaming\Download\129056.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3964
        • C:\Users\Admin\AppData\Roaming\Download\182830.exe
          "C:\Users\Admin\AppData\Roaming\Download\182830.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4608
          • C:\Users\Admin\AppData\Roaming\Download\182830.exe
            "C:\Users\Admin\AppData\Roaming\Download\182830.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2884
        • C:\Users\Admin\AppData\Roaming\Download\545533.exe
          "C:\Users\Admin\AppData\Roaming\Download\545533.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3900
          • C:\Users\Admin\AppData\Roaming\Download\545533.exe
            "C:\Users\Admin\AppData\Roaming\Download\545533.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1084
        • C:\Users\Admin\AppData\Roaming\Download\398979.exe
          "C:\Users\Admin\AppData\Roaming\Download\398979.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:3744
          • C:\Users\Admin\AppData\Roaming\Download\398979.exe
            "C:\Users\Admin\AppData\Roaming\Download\398979.exe"
            5⤵
            • Executes dropped EXE
            PID:2476
        • C:\Users\Admin\AppData\Roaming\Download\637878.exe
          "C:\Users\Admin\AppData\Roaming\Download\637878.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1492
          • C:\Users\Admin\AppData\Roaming\Download\637878.exe
            "C:\Users\Admin\AppData\Roaming\Download\637878.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3348
        • C:\Users\Admin\AppData\Roaming\Download\928481.exe
          "C:\Users\Admin\AppData\Roaming\Download\928481.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4796
          • C:\Users\Admin\AppData\Roaming\Download\928481.exe
            "C:\Users\Admin\AppData\Roaming\Download\928481.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2072
        • C:\Users\Admin\AppData\Roaming\Download\214181.exe
          "C:\Users\Admin\AppData\Roaming\Download\214181.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2732
          • C:\Users\Admin\AppData\Roaming\Download\214181.exe
            "C:\Users\Admin\AppData\Roaming\Download\214181.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3164
        • C:\Users\Admin\AppData\Roaming\Download\880043.exe
          "C:\Users\Admin\AppData\Roaming\Download\880043.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2860
          • C:\Users\Admin\AppData\Roaming\Download\880043.exe
            "C:\Users\Admin\AppData\Roaming\Download\880043.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4924
        • C:\Users\Admin\AppData\Roaming\Download\091509.exe
          "C:\Users\Admin\AppData\Roaming\Download\091509.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1772
          • C:\Users\Admin\AppData\Roaming\Download\091509.exe
            "C:\Users\Admin\AppData\Roaming\Download\091509.exe"
            5⤵
            • Executes dropped EXE
            PID:1844
        • C:\Users\Admin\AppData\Roaming\Download\636955.exe
          "C:\Users\Admin\AppData\Roaming\Download\636955.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5000
          • C:\Users\Admin\AppData\Roaming\Download\636955.exe
            "C:\Users\Admin\AppData\Roaming\Download\636955.exe"
            5⤵
            • Executes dropped EXE
            PID:3552
        • C:\Users\Admin\AppData\Roaming\Download\199648.exe
          "C:\Users\Admin\AppData\Roaming\Download\199648.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5484
          • C:\Users\Admin\AppData\Roaming\Download\199648.exe
            "C:\Users\Admin\AppData\Roaming\Download\199648.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1596
        • C:\Users\Admin\AppData\Roaming\Download\597363.exe
          "C:\Users\Admin\AppData\Roaming\Download\597363.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:1136
          • C:\Users\Admin\AppData\Roaming\Download\597363.exe
            "C:\Users\Admin\AppData\Roaming\Download\597363.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2916
        • C:\Users\Admin\AppData\Roaming\Download\091891.exe
          "C:\Users\Admin\AppData\Roaming\Download\091891.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5212
          • C:\Users\Admin\AppData\Roaming\Download\091891.exe
            "C:\Users\Admin\AppData\Roaming\Download\091891.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5580
        • C:\Users\Admin\AppData\Roaming\Download\826037.exe
          "C:\Users\Admin\AppData\Roaming\Download\826037.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4776
          • C:\Users\Admin\AppData\Roaming\Download\826037.exe
            "C:\Users\Admin\AppData\Roaming\Download\826037.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2160
        • C:\Users\Admin\AppData\Roaming\Download\811305.exe
          "C:\Users\Admin\AppData\Roaming\Download\811305.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5476
          • C:\Users\Admin\AppData\Roaming\Download\811305.exe
            "C:\Users\Admin\AppData\Roaming\Download\811305.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1060
        • C:\Users\Admin\AppData\Roaming\Download\760804.exe
          "C:\Users\Admin\AppData\Roaming\Download\760804.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4296
          • C:\Users\Admin\AppData\Roaming\Download\760804.exe
            "C:\Users\Admin\AppData\Roaming\Download\760804.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3264
        • C:\Users\Admin\AppData\Roaming\Download\504250.exe
          "C:\Users\Admin\AppData\Roaming\Download\504250.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2916
          • C:\Users\Admin\AppData\Roaming\Download\504250.exe
            "C:\Users\Admin\AppData\Roaming\Download\504250.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6016
        • C:\Users\Admin\AppData\Roaming\Download\853039.exe
          "C:\Users\Admin\AppData\Roaming\Download\853039.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4148
          • C:\Users\Admin\AppData\Roaming\Download\853039.exe
            "C:\Users\Admin\AppData\Roaming\Download\853039.exe"
            5⤵
            • Executes dropped EXE
            PID:2888
        • C:\Users\Admin\AppData\Roaming\Download\040847.exe
          "C:\Users\Admin\AppData\Roaming\Download\040847.exe" /Shorttailedrestart
          4⤵
          • Executes dropped EXE
          PID:2468
          • C:\Users\Admin\AppData\Roaming\Download\040847.exe
            "C:\Users\Admin\AppData\Roaming\Download\040847.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4100
        • C:\Users\Admin\AppData\Roaming\Download\579724.exe
          "C:\Users\Admin\AppData\Roaming\Download\579724.exe" /Shorttailedrestart
          4⤵
            PID:2600
            • C:\Users\Admin\AppData\Roaming\Download\579724.exe
              "C:\Users\Admin\AppData\Roaming\Download\579724.exe"
              5⤵
                PID:1304
            • C:\Users\Admin\AppData\Roaming\Download\979438.exe
              "C:\Users\Admin\AppData\Roaming\Download\979438.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2084
              • C:\Users\Admin\AppData\Roaming\Download\979438.exe
                "C:\Users\Admin\AppData\Roaming\Download\979438.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5060
            • C:\Users\Admin\AppData\Roaming\Download\260042.exe
              "C:\Users\Admin\AppData\Roaming\Download\260042.exe" /Shorttailedrestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4884
              • C:\Users\Admin\AppData\Roaming\Download\260042.exe
                "C:\Users\Admin\AppData\Roaming\Download\260042.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5320
            • C:\Users\Admin\AppData\Roaming\Download\729940.exe
              "C:\Users\Admin\AppData\Roaming\Download\729940.exe" /Shorttailedrestart
              4⤵
                PID:2532
                • C:\Users\Admin\AppData\Roaming\Download\729940.exe
                  "C:\Users\Admin\AppData\Roaming\Download\729940.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3392
              • C:\Users\Admin\AppData\Roaming\Download\600390.exe
                "C:\Users\Admin\AppData\Roaming\Download\600390.exe" /Shorttailedrestart
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1508
                • C:\Users\Admin\AppData\Roaming\Download\600390.exe
                  "C:\Users\Admin\AppData\Roaming\Download\600390.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1316
              • C:\Users\Admin\AppData\Roaming\Download\104901.exe
                "C:\Users\Admin\AppData\Roaming\Download\104901.exe" /Shorttailedrestart
                4⤵
                  PID:1816
                  • C:\Users\Admin\AppData\Roaming\Download\104901.exe
                    "C:\Users\Admin\AppData\Roaming\Download\104901.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5040
                • C:\Users\Admin\AppData\Roaming\Download\826430.exe
                  "C:\Users\Admin\AppData\Roaming\Download\826430.exe" /Shorttailedrestart
                  4⤵
                    PID:1428
                    • C:\Users\Admin\AppData\Roaming\Download\826430.exe
                      "C:\Users\Admin\AppData\Roaming\Download\826430.exe"
                      5⤵
                        PID:1524
                    • C:\Users\Admin\AppData\Roaming\Download\329061.exe
                      "C:\Users\Admin\AppData\Roaming\Download\329061.exe" /Shorttailedrestart
                      4⤵
                        PID:3208
                        • C:\Users\Admin\AppData\Roaming\Download\329061.exe
                          "C:\Users\Admin\AppData\Roaming\Download\329061.exe"
                          5⤵
                            PID:1604
                        • C:\Users\Admin\AppData\Roaming\Download\790685.exe
                          "C:\Users\Admin\AppData\Roaming\Download\790685.exe" /Shorttailedrestart
                          4⤵
                            PID:5600
                            • C:\Users\Admin\AppData\Roaming\Download\790685.exe
                              "C:\Users\Admin\AppData\Roaming\Download\790685.exe"
                              5⤵
                                PID:5060
                            • C:\Users\Admin\AppData\Roaming\Download\353009.exe
                              "C:\Users\Admin\AppData\Roaming\Download\353009.exe" /Shorttailedrestart
                              4⤵
                                PID:1588
                                • C:\Users\Admin\AppData\Roaming\Download\353009.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\353009.exe"
                                  5⤵
                                    PID:1652
                                • C:\Users\Admin\AppData\Roaming\Download\892808.exe
                                  "C:\Users\Admin\AppData\Roaming\Download\892808.exe" /Shorttailedrestart
                                  4⤵
                                    PID:2556
                                    • C:\Users\Admin\AppData\Roaming\Download\892808.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\892808.exe"
                                      5⤵
                                        PID:5972
                                    • C:\Users\Admin\AppData\Roaming\Download\041705.exe
                                      "C:\Users\Admin\AppData\Roaming\Download\041705.exe" /Shorttailedrestart
                                      4⤵
                                        PID:3392
                                        • C:\Users\Admin\AppData\Roaming\Download\041705.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\041705.exe"
                                          5⤵
                                            PID:868
                                        • C:\Users\Admin\AppData\Roaming\Download\297688.exe
                                          "C:\Users\Admin\AppData\Roaming\Download\297688.exe" /Shorttailedrestart
                                          4⤵
                                            PID:4880
                                            • C:\Users\Admin\AppData\Roaming\Download\297688.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\297688.exe"
                                              5⤵
                                                PID:3532
                                            • C:\Users\Admin\AppData\Roaming\Download\829107.exe
                                              "C:\Users\Admin\AppData\Roaming\Download\829107.exe" /Shorttailedrestart
                                              4⤵
                                                PID:3552
                                                • C:\Users\Admin\AppData\Roaming\Download\829107.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\829107.exe"
                                                  5⤵
                                                    PID:3376
                                                • C:\Users\Admin\AppData\Roaming\Download\913555.exe
                                                  "C:\Users\Admin\AppData\Roaming\Download\913555.exe" /Shorttailedrestart
                                                  4⤵
                                                    PID:1812
                                                    • C:\Users\Admin\AppData\Roaming\Download\913555.exe
                                                      "C:\Users\Admin\AppData\Roaming\Download\913555.exe"
                                                      5⤵
                                                        PID:3844
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c
                                                  2⤵
                                                  • Drops file in Windows directory
                                                  • Enumerates system info in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4564
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
                                                    3⤵
                                                      PID:5764
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,16322131863406852886,4929711981325539354,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
                                                      3⤵
                                                      • System Time Discovery
                                                      PID:4188
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,527774107258884511,13305104289535604727,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
                                                      3⤵
                                                        PID:4076
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15314195406122503410,2871674941048884768,262144 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
                                                        3⤵
                                                          PID:4060
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,10083362754571695439,41016929080896154,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                                                          3⤵
                                                            PID:3900
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1416237816847063564,426282546800184426,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                                                            3⤵
                                                              PID:1356
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,13948312323529398657,3356717169970111181,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
                                                              3⤵
                                                                PID:1728
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,18209167940636485291,18405387191916543918,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
                                                                3⤵
                                                                  PID:4892
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13511308938920839920,16430146774704393058,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
                                                                  3⤵
                                                                    PID:2432
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,5305701780016343646,1701443189450040897,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
                                                                    3⤵
                                                                      PID:5276
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15773648427957374799,6942119357171119486,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                                                                      3⤵
                                                                        PID:2400
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5740,i,11878113144495928268,18290794853617747023,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
                                                                        3⤵
                                                                          PID:5664
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3118012708330679018,3397938267457363906,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
                                                                          3⤵
                                                                            PID:2936
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3118012708330679018,3397938267457363906,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
                                                                            3⤵
                                                                              PID:2384
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7278822310010090163,12857067460608272425,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
                                                                              3⤵
                                                                                PID:1192
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1890232741564020097,12711684563984646414,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
                                                                                3⤵
                                                                                  PID:1844
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,17993493277574998138,3676631562896958516,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
                                                                                  3⤵
                                                                                    PID:6024
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,5359696324109758687,17082587299122627803,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
                                                                                    3⤵
                                                                                    • Modifies registry class
                                                                                    PID:4596
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,10959672242061986178,5622252612534875134,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:12
                                                                                    3⤵
                                                                                      PID:3056
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,5903808665807721849,16461458581903162391,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
                                                                                      3⤵
                                                                                        PID:1216
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7560,i,17305284168531595575,2916564284271376636,2097152 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
                                                                                        3⤵
                                                                                          PID:4420
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13252509329508888540,6152538462406444289,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
                                                                                          3⤵
                                                                                            PID:5272
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1791487940585342463,15919817837830321985,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                                                                            3⤵
                                                                                              PID:3724
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6479678979119601772,8653383534953695440,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
                                                                                              3⤵
                                                                                                PID:3240
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15950300482558641218,3363043231934291476,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:4464
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15386149426714460191,8936205196576643772,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:1292
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,8856109913880600721,13975195877648018840,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
                                                                                                    3⤵
                                                                                                      PID:5316
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,12827356718188533517,13917850272594618566,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
                                                                                                      3⤵
                                                                                                        PID:3552
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6408,i,9026815002408239871,11766695594695172867,262144 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:10
                                                                                                        3⤵
                                                                                                          PID:4860
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16370731583961453177,17460103533404928971,524288 --field-trial-handle=2208,i,8259069686868347740,9645726434248194514,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:1548
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                          2⤵
                                                                                                            PID:5128
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3600
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:2340
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                          1⤵
                                                                                                            PID:4808
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                            1⤵
                                                                                                              PID:6140

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  DouTuDaShi.exe
                                                                                                                  • Path C:\Program Files (x86)\DouTu\DouTuDaShi.exe
                                                                                                                  • Size 1.1MB
                                                                                                                  • SHA256 f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  blocklist
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                  • Size 105KB
                                                                                                                  • SHA256 f32c5d9efb1ab4f2e9cb6d708b48d04144a1c342b53574c8f51378e2f5200543
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                  • Size 6B
                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  96f9b4f9adf74a24_0
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96f9b4f9adf74a24_0
                                                                                                                  • Size 213B
                                                                                                                  • SHA256 d945ef6efef4e4714bcbf27afbaa44c6be5a7ce9bcdd227129aa07b8e9d5d9fc
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 4KB
                                                                                                                  • SHA256 c4244342db323971408730bfd5e994c8e9eacc5d9a0b0ad7eb04faaf3693eea0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index~RFe5a34cd.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a34cd.TMP
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 5cae4677da8c281765c126b088f72c4edd8afe69147e9863058514f12692c44e
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  SiteList-Enterprise.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                  • Size 2B
                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Edge Profile.ico
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                  • Size 70KB
                                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 5KB
                                                                                                                  • SHA256 89bc2a5c25ab7558e347e316e00628ed3fa63d00f8be1e572083e93093e4924d
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  SCT Auditing Pending Reports
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                  • Size 2B
                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Sdch Dictionaries
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                  • Size 40B
                                                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                  • Size 15KB
                                                                                                                  • SHA256 43ddf9a738722ca82ca0f53036e7ce667d4370ec25191a5140135ae18b8ee0fe
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                  • Size 15KB
                                                                                                                  • SHA256 4a013dcd524d9ec05b38ab22eb14c2df91e9bcd9d1ae812ff1506ac99940f384
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                  • Size 16KB
                                                                                                                  • SHA256 144caa979a3049144d4cc06e51836cb0c6e2354dd3736736ddc167aced6e8ff1
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Secure Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                  • Size 30KB
                                                                                                                  • SHA256 dcc19495c6dfb6ebc520d82e6c236d6b675451b319a0287d4804126fb6741fdb
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  sync_diagnostic.log
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                  • Size 4KB
                                                                                                                  • SHA256 99fb6b1a7391345e8dd2cbe751362c5f93229bc08b88eecf0889a4a946eaad8e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 38KB
                                                                                                                  • SHA256 c157ca6b21bfdd927e030db9384e67dac6d23f5802ea88d38adefe5d515fd39f
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 35KB
                                                                                                                  • SHA256 433738e8c367df2477fe067c16d01bad7d35fb7997435fbe4631cbeed83e048c
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 41KB
                                                                                                                  • SHA256 06622ef10ce29268f299ebf66e5bfe17e967e4a88b3fb5d6e9e0942a49c5b53e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 39KB
                                                                                                                  • SHA256 d79ac875010d26ef3bca3b4945cb422e01520108218fea82033ad1368a57c6cb
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 38KB
                                                                                                                  • SHA256 d77fa2e7570f06c9bf3bb7139c7a6d2f72e2b0d83be92024c4cf83d8ae3f8757
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                  • Size 38KB
                                                                                                                  • SHA256 a6afcf7cb1185db8efb6ed45f2368e7456fd4d0a617764488285fbec8af979d7
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  metadata.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                  • Size 252B
                                                                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  metadata.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                  • Size 132B
                                                                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  metadata.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                  • Size 372B
                                                                                                                  • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                  • Size 153KB
                                                                                                                  • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  metadata.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                  • Size 13B
                                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  metadata.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                  • Size 132B
                                                                                                                  • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  699b1bc0-968a-4474-bda4-f7ff377e8b97.tmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\699b1bc0-968a-4474-bda4-f7ff377e8b97.tmp
                                                                                                                  • Size 1B
                                                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  ldsajdklsajdlkjsalkda.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
                                                                                                                  • Size 589B
                                                                                                                  • SHA256 20cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  rtxibr.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\rtxibr.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 30d45365fb05c82aaee5251e7b88c6d7a344b8fb4673f259a6bf70360a20fe7b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  content_new.js
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4564_1223402172\CRX_INSTALL\content_new.js
                                                                                                                  • Size 10KB
                                                                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  117694.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\117694.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 8fc2f7a8c16a82a4db77685c9b01581e238ef7934dbd7b184623fc7644cac0a4
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  129056.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\129056.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 f0fd45071ebeaca502b3d7baf82f6b1067806740608d6d1a2a98633f4f7b2253
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  177547.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\177547.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 da8f641591f90b83eb980b714cef6b45468056a41c60cddee36b253de7ca1d17
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  186291.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\186291.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 32fc45dd5d001b8a2cdea96c690d372d8644b8af80d126f4da7f1eb7e0b04a1f
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  243335.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\243335.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 2a81a2900be6dfe8aa7aea858c5c59545d4214f3c05a856b69e38918edef7b05
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  271895.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\271895.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 82fa2867c464754b4888ccb6e928a3ee909233204170c24873821fd516d5a1df
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  342310.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\342310.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 b8b69e3e6616efa560fd2906c776a0ba78b3bdc1b55ec14b4cf565a8cab08e67
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  542743.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\542743.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 ce2f4f6447cb0bdd501412e2ec8f716976976fd5d98cfe7cc7c856f6750a5768
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  644964.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\644964.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 a48243a6a29c73dd5474458e00145e9f4e280851c892c72c2958941940db3cba
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  724477.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\724477.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 79cdeabf819441ae2c7146ca6e28042087222cb4aeefe8216f2fda11a9da62b2
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  814719.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\814719.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 4b0b6b22a5663bfe6862aaced5a90df82596bdeb0acdc5b53d8d788d52b31eb1
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  841693.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\841693.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 a897bed1e58144d5ca822c1878d7aa0556fbe1c2291b31d8b70a115823942359
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  928747.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Download\928747.exe
                                                                                                                  • Size 1.5MB
                                                                                                                  • SHA256 064bd3cf2579136dca8d2bb87ff99ede6cacfb829918e478d205b260239cc813
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  memory/3312-19-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3872-106-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1004-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-819-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-959-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-688-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-864-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1049-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-896-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1094-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1130-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-755-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1176-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-202-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-1222-0x0000000000400000-0x000000000059A000-memory.dmp
                                                                                                                  Download