Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 04:39
General
- Target 2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample260928-e927kage85
- SHA256 768b5a50e8e311f8a8e7b9ec1e843b5add1186c29d758d5b16c12042ea5ea37f
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 50 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 30 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\yuqvzt.exe"C:\Users\Admin\AppData\Local\Temp\yuqvzt.exe" /jscxyxztjkl2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yuqvzt.exe"C:\Users\Admin\AppData\Local\Temp\yuqvzt.exe" /jsjczxztcq3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\571465.exe"C:\Users\Admin\AppData\Roaming\Download\571465.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\571465.exe"C:\Users\Admin\AppData\Roaming\Download\571465.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\219717.exe"C:\Users\Admin\AppData\Roaming\Download\219717.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\219717.exe"C:\Users\Admin\AppData\Roaming\Download\219717.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\600321.exe"C:\Users\Admin\AppData\Roaming\Download\600321.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\600321.exe"C:\Users\Admin\AppData\Roaming\Download\600321.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\783672.exe"C:\Users\Admin\AppData\Roaming\Download\783672.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\783672.exe"C:\Users\Admin\AppData\Roaming\Download\783672.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\285101.exe"C:\Users\Admin\AppData\Roaming\Download\285101.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\285101.exe"C:\Users\Admin\AppData\Roaming\Download\285101.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\154368.exe"C:\Users\Admin\AppData\Roaming\Download\154368.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\154368.exe"C:\Users\Admin\AppData\Roaming\Download\154368.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\189426.exe"C:\Users\Admin\AppData\Roaming\Download\189426.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\189426.exe"C:\Users\Admin\AppData\Roaming\Download\189426.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\159503.exe"C:\Users\Admin\AppData\Roaming\Download\159503.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\159503.exe"C:\Users\Admin\AppData\Roaming\Download\159503.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\385486.exe"C:\Users\Admin\AppData\Roaming\Download\385486.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\385486.exe"C:\Users\Admin\AppData\Roaming\Download\385486.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\562283.exe"C:\Users\Admin\AppData\Roaming\Download\562283.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\562283.exe"C:\Users\Admin\AppData\Roaming\Download\562283.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\653732.exe"C:\Users\Admin\AppData\Roaming\Download\653732.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\653732.exe"C:\Users\Admin\AppData\Roaming\Download\653732.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\808715.exe"C:\Users\Admin\AppData\Roaming\Download\808715.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\808715.exe"C:\Users\Admin\AppData\Roaming\Download\808715.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\086702.exe"C:\Users\Admin\AppData\Roaming\Download\086702.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\086702.exe"C:\Users\Admin\AppData\Roaming\Download\086702.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\411685.exe"C:\Users\Admin\AppData\Roaming\Download\411685.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\411685.exe"C:\Users\Admin\AppData\Roaming\Download\411685.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\454941.exe"C:\Users\Admin\AppData\Roaming\Download\454941.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\454941.exe"C:\Users\Admin\AppData\Roaming\Download\454941.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\486019.exe"C:\Users\Admin\AppData\Roaming\Download\486019.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\486019.exe"C:\Users\Admin\AppData\Roaming\Download\486019.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\629374.exe"C:\Users\Admin\AppData\Roaming\Download\629374.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\629374.exe"C:\Users\Admin\AppData\Roaming\Download\629374.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\367194.exe"C:\Users\Admin\AppData\Roaming\Download\367194.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\367194.exe"C:\Users\Admin\AppData\Roaming\Download\367194.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\521065.exe"C:\Users\Admin\AppData\Roaming\Download\521065.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\521065.exe"C:\Users\Admin\AppData\Roaming\Download\521065.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\422516.exe"C:\Users\Admin\AppData\Roaming\Download\422516.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\422516.exe"C:\Users\Admin\AppData\Roaming\Download\422516.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\654671.exe"C:\Users\Admin\AppData\Roaming\Download\654671.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\654671.exe"C:\Users\Admin\AppData\Roaming\Download\654671.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\424206.exe"C:\Users\Admin\AppData\Roaming\Download\424206.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\424206.exe"C:\Users\Admin\AppData\Roaming\Download\424206.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\570198.exe"C:\Users\Admin\AppData\Roaming\Download\570198.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\570198.exe"C:\Users\Admin\AppData\Roaming\Download\570198.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\892454.exe"C:\Users\Admin\AppData\Roaming\Download\892454.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\892454.exe"C:\Users\Admin\AppData\Roaming\Download\892454.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\948437.exe"C:\Users\Admin\AppData\Roaming\Download\948437.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\948437.exe"C:\Users\Admin\AppData\Roaming\Download\948437.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\235424.exe"C:\Users\Admin\AppData\Roaming\Download\235424.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\235424.exe"C:\Users\Admin\AppData\Roaming\Download\235424.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\113859.exe"C:\Users\Admin\AppData\Roaming\Download\113859.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\113859.exe"C:\Users\Admin\AppData\Roaming\Download\113859.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\503773.exe"C:\Users\Admin\AppData\Roaming\Download\503773.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\503773.exe"C:\Users\Admin\AppData\Roaming\Download\503773.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\526839.exe"C:\Users\Admin\AppData\Roaming\Download\526839.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\526839.exe"C:\Users\Admin\AppData\Roaming\Download\526839.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\878015.exe"C:\Users\Admin\AppData\Roaming\Download\878015.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\878015.exe"C:\Users\Admin\AppData\Roaming\Download\878015.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\893173.exe"C:\Users\Admin\AppData\Roaming\Download\893173.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\893173.exe"C:\Users\Admin\AppData\Roaming\Download\893173.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\671707.exe"C:\Users\Admin\AppData\Roaming\Download\671707.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\671707.exe"C:\Users\Admin\AppData\Roaming\Download\671707.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\572258.exe"C:\Users\Admin\AppData\Roaming\Download\572258.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\572258.exe"C:\Users\Admin\AppData\Roaming\Download\572258.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\969055.exe"C:\Users\Admin\AppData\Roaming\Download\969055.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\969055.exe"C:\Users\Admin\AppData\Roaming\Download\969055.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\081311.exe"C:\Users\Admin\AppData\Roaming\Download\081311.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\081311.exe"C:\Users\Admin\AppData\Roaming\Download\081311.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\964662.exe"C:\Users\Admin\AppData\Roaming\Download\964662.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\964662.exe"C:\Users\Admin\AppData\Roaming\Download\964662.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\563276.exe"C:\Users\Admin\AppData\Roaming\Download\563276.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\563276.exe"C:\Users\Admin\AppData\Roaming\Download\563276.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\466707.exe"C:\Users\Admin\AppData\Roaming\Download\466707.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\466707.exe"C:\Users\Admin\AppData\Roaming\Download\466707.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\488883.exe"C:\Users\Admin\AppData\Roaming\Download\488883.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\488883.exe"C:\Users\Admin\AppData\Roaming\Download\488883.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\703672.exe"C:\Users\Admin\AppData\Roaming\Download\703672.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\703672.exe"C:\Users\Admin\AppData\Roaming\Download\703672.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\452335.exe"C:\Users\Admin\AppData\Roaming\Download\452335.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\452335.exe"C:\Users\Admin\AppData\Roaming\Download\452335.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\220960.exe"C:\Users\Admin\AppData\Roaming\Download\220960.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\220960.exe"C:\Users\Admin\AppData\Roaming\Download\220960.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\200396.exe"C:\Users\Admin\AppData\Roaming\Download\200396.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\200396.exe"C:\Users\Admin\AppData\Roaming\Download\200396.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\242652.exe"C:\Users\Admin\AppData\Roaming\Download\242652.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\242652.exe"C:\Users\Admin\AppData\Roaming\Download\242652.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\020206.exe"C:\Users\Admin\AppData\Roaming\Download\020206.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\020206.exe"C:\Users\Admin\AppData\Roaming\Download\020206.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\342272.exe"C:\Users\Admin\AppData\Roaming\Download\342272.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\342272.exe"C:\Users\Admin\AppData\Roaming\Download\342272.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\498454.exe"C:\Users\Admin\AppData\Roaming\Download\498454.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\498454.exe"C:\Users\Admin\AppData\Roaming\Download\498454.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffd648dc188,0x7ffd648dc194,0x7ffd648dc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2096096315440673914,18029676442830622980,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16531456768563114046,1110658242405867508,262144 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,14849180456598740723,1153977914620067973,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,7321624629635828748,7300472348169421691,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,12310303485631148540,1806186128364227024,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,10673936318786749196,8149669223106634229,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,15659782887929404643,12554444382856075374,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,5388109114534119531,14055968481015487679,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12090876440309415817,13322749892330241201,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,14762820193475198369,5400700242274307502,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,6588064780419687936,14279054546532252721,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,1832046612729193589,7155510301151168325,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,1832046612729193589,7155510301151168325,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,10110743508960519769,5425803192178836193,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15835886548509515948,468033203685108283,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5182740236607257904,12526678911879976505,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10034269903050392325,6082919532299224002,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6160,i,13910660450774532148,4184101114845866974,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,15732117648726675651,17225415072523010949,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,17904571266318790215,7877549668347885395,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1417078609450644851,10688388719218242404,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6236,i,6663672766638077562,15875393742328133040,2097152 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,3322833773247029094,15589220585471586901,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,8857974650112601420,3374185412853205827,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2614994887793571302,9239094920829896406,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15623891959609538399,3785283231290945494,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,10916664180616794372,5459476876308821726,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,10873766496324200794,15997285025485747826,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7502458917846184783,15848261255605202002,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6980,i,4981898096125381076,3711054891876519629,262144 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11391356729302057832,15952389749155643087,524288 --field-trial-handle=2556,i,100858433234387956,8738327755882619245,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:83⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
manifest.json
manifest.json
manifest.json
manifest.json
blocklist
protocols.json
settings.dat
settings.dat
012f28a6-7138-4b22-b9d7-8003e618d69c.tmp
76afe6af-6cf4-449a-9903-5e494de592c2.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe595078.TMP
SiteList-Enterprise.json
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
sync_diagnostic.log
206c523e-b8c6-40cc-a16b-c4a97c657810.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
7eef4bcb-0d11-4f75-a8f7-ca31786934db.tmp
hao.360[1].xml
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
113[1].js
1[1].png
sed_api_weather_info[1].htm
34b0b9a6-315d-4499-a6bd-5965a5c53a76.tmp
75a9ebbe-203c-438e-9203-6a6e97413644.tmp
ldsajdklsajdlkjsalkda.bat
content_new.js
709b7795-5294-48bd-ab54-b020dd4ea269.tmp
yuqvzt.exe
154368.exe
159503.exe
189426.exe
219717.exe
285101.exe
385486.exe
562283.exe
571465.exe
600321.exe
653732.exe
783672.exe
808715.exe
memory/1460-131-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1099-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1376-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1430-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1325-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1492-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-790-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1537-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-954-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1580-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-1626-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3144-296-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3920-137-0x000000000F430000-0x000000000F530000-memory.dmp
memory/3920-146-0x000000000F880000-0x000000000F980000-memory.dmp