Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 15:18
General
- Target 2026-10-01_4a747de38a3d9afa5d6c1a09e09ca5b5_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261002-sp1d5ach47
- SHA256 99e671f3315489d8e426a53a4b90e8533375f271c57a27d4ad6f9be55957ff18
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 30 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_4a747de38a3d9afa5d6c1a09e09ca5b5_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4a747de38a3d9afa5d6c1a09e09ca5b5_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bzjjkh.exe"C:\Users\Admin\AppData\Local\Temp\bzjjkh.exe" /jscxyxztjkl2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bzjjkh.exe"C:\Users\Admin\AppData\Local\Temp\bzjjkh.exe" /jsjczxztcq3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\824052.exe"C:\Users\Admin\AppData\Roaming\Download\824052.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\824052.exe"C:\Users\Admin\AppData\Roaming\Download\824052.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\014677.exe"C:\Users\Admin\AppData\Roaming\Download\014677.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\014677.exe"C:\Users\Admin\AppData\Roaming\Download\014677.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\449550.exe"C:\Users\Admin\AppData\Roaming\Download\449550.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\449550.exe"C:\Users\Admin\AppData\Roaming\Download\449550.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\075996.exe"C:\Users\Admin\AppData\Roaming\Download\075996.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\075996.exe"C:\Users\Admin\AppData\Roaming\Download\075996.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\120178.exe"C:\Users\Admin\AppData\Roaming\Download\120178.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\120178.exe"C:\Users\Admin\AppData\Roaming\Download\120178.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\729890.exe"C:\Users\Admin\AppData\Roaming\Download\729890.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\729890.exe"C:\Users\Admin\AppData\Roaming\Download\729890.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\602011.exe"C:\Users\Admin\AppData\Roaming\Download\602011.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\602011.exe"C:\Users\Admin\AppData\Roaming\Download\602011.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\858294.exe"C:\Users\Admin\AppData\Roaming\Download\858294.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\858294.exe"C:\Users\Admin\AppData\Roaming\Download\858294.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\491440.exe"C:\Users\Admin\AppData\Roaming\Download\491440.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\491440.exe"C:\Users\Admin\AppData\Roaming\Download\491440.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\747522.exe"C:\Users\Admin\AppData\Roaming\Download\747522.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\747522.exe"C:\Users\Admin\AppData\Roaming\Download\747522.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\862503.exe"C:\Users\Admin\AppData\Roaming\Download\862503.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\862503.exe"C:\Users\Admin\AppData\Roaming\Download\862503.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\875054.exe"C:\Users\Admin\AppData\Roaming\Download\875054.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\875054.exe"C:\Users\Admin\AppData\Roaming\Download\875054.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\243841.exe"C:\Users\Admin\AppData\Roaming\Download\243841.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\243841.exe"C:\Users\Admin\AppData\Roaming\Download\243841.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\876746.exe"C:\Users\Admin\AppData\Roaming\Download\876746.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\876746.exe"C:\Users\Admin\AppData\Roaming\Download\876746.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\307275.exe"C:\Users\Admin\AppData\Roaming\Download\307275.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\307275.exe"C:\Users\Admin\AppData\Roaming\Download\307275.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\653358.exe"C:\Users\Admin\AppData\Roaming\Download\653358.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\653358.exe"C:\Users\Admin\AppData\Roaming\Download\653358.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\534608.exe"C:\Users\Admin\AppData\Roaming\Download\534608.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\534608.exe"C:\Users\Admin\AppData\Roaming\Download\534608.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\780889.exe"C:\Users\Admin\AppData\Roaming\Download\780889.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\780889.exe"C:\Users\Admin\AppData\Roaming\Download\780889.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\281493.exe"C:\Users\Admin\AppData\Roaming\Download\281493.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\281493.exe"C:\Users\Admin\AppData\Roaming\Download\281493.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\671107.exe"C:\Users\Admin\AppData\Roaming\Download\671107.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\671107.exe"C:\Users\Admin\AppData\Roaming\Download\671107.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\552458.exe"C:\Users\Admin\AppData\Roaming\Download\552458.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\552458.exe"C:\Users\Admin\AppData\Roaming\Download\552458.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\056967.exe"C:\Users\Admin\AppData\Roaming\Download\056967.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\056967.exe"C:\Users\Admin\AppData\Roaming\Download\056967.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\267861.exe"C:\Users\Admin\AppData\Roaming\Download\267861.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\267861.exe"C:\Users\Admin\AppData\Roaming\Download\267861.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\158102.exe"C:\Users\Admin\AppData\Roaming\Download\158102.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\158102.exe"C:\Users\Admin\AppData\Roaming\Download\158102.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\407089.exe"C:\Users\Admin\AppData\Roaming\Download\407089.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\407089.exe"C:\Users\Admin\AppData\Roaming\Download\407089.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\620275.exe"C:\Users\Admin\AppData\Roaming\Download\620275.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\620275.exe"C:\Users\Admin\AppData\Roaming\Download\620275.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\672331.exe"C:\Users\Admin\AppData\Roaming\Download\672331.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\672331.exe"C:\Users\Admin\AppData\Roaming\Download\672331.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\859329.exe"C:\Users\Admin\AppData\Roaming\Download\859329.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\859329.exe"C:\Users\Admin\AppData\Roaming\Download\859329.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\040670.exe"C:\Users\Admin\AppData\Roaming\Download\040670.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\040670.exe"C:\Users\Admin\AppData\Roaming\Download\040670.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\228677.exe"C:\Users\Admin\AppData\Roaming\Download\228677.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\228677.exe"C:\Users\Admin\AppData\Roaming\Download\228677.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\111918.exe"C:\Users\Admin\AppData\Roaming\Download\111918.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\111918.exe"C:\Users\Admin\AppData\Roaming\Download\111918.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\608916.exe"C:\Users\Admin\AppData\Roaming\Download\608916.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\608916.exe"C:\Users\Admin\AppData\Roaming\Download\608916.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\589167.exe"C:\Users\Admin\AppData\Roaming\Download\589167.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\589167.exe"C:\Users\Admin\AppData\Roaming\Download\589167.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\776954.exe"C:\Users\Admin\AppData\Roaming\Download\776954.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\776954.exe"C:\Users\Admin\AppData\Roaming\Download\776954.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\757405.exe"C:\Users\Admin\AppData\Roaming\Download\757405.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\757405.exe"C:\Users\Admin\AppData\Roaming\Download\757405.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\144293.exe"C:\Users\Admin\AppData\Roaming\Download\144293.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\144293.exe"C:\Users\Admin\AppData\Roaming\Download\144293.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\025744.exe"C:\Users\Admin\AppData\Roaming\Download\025744.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\025744.exe"C:\Users\Admin\AppData\Roaming\Download\025744.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\271626.exe"C:\Users\Admin\AppData\Roaming\Download\271626.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\271626.exe"C:\Users\Admin\AppData\Roaming\Download\271626.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\493992.exe"C:\Users\Admin\AppData\Roaming\Download\493992.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\493992.exe"C:\Users\Admin\AppData\Roaming\Download\493992.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\448058.exe"C:\Users\Admin\AppData\Roaming\Download\448058.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\448058.exe"C:\Users\Admin\AppData\Roaming\Download\448058.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\460316.exe"C:\Users\Admin\AppData\Roaming\Download\460316.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\460316.exe"C:\Users\Admin\AppData\Roaming\Download\460316.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\661865.exe"C:\Users\Admin\AppData\Roaming\Download\661865.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\661865.exe"C:\Users\Admin\AppData\Roaming\Download\661865.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\450802.exe"C:\Users\Admin\AppData\Roaming\Download\450802.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\450802.exe"C:\Users\Admin\AppData\Roaming\Download\450802.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\361253.exe"C:\Users\Admin\AppData\Roaming\Download\361253.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\361253.exe"C:\Users\Admin\AppData\Roaming\Download\361253.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\748041.exe"C:\Users\Admin\AppData\Roaming\Download\748041.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\748041.exe"C:\Users\Admin\AppData\Roaming\Download\748041.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\871309.exe"C:\Users\Admin\AppData\Roaming\Download\871309.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\871309.exe"C:\Users\Admin\AppData\Roaming\Download\871309.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\754658.exe"C:\Users\Admin\AppData\Roaming\Download\754658.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\754658.exe"C:\Users\Admin\AppData\Roaming\Download\754658.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\149655.exe"C:\Users\Admin\AppData\Roaming\Download\149655.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\149655.exe"C:\Users\Admin\AppData\Roaming\Download\149655.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffc5813c188,0x7ffc5813c194,0x7ffc5813c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,3852082097545612558,10452599704596205508,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3069091301533121211,14552149279305219223,262144 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,11381167545295664190,9533468762779966796,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,16761238781803129585,15803715918471076453,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,2139453729648882604,8142717278212732624,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,4102657458913743910,3130187050973796380,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8865644742326163364,12331302069361356723,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,1640393349223615949,688182092526627409,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,3602744736460046658,13415038814903535498,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,3533366222021570621,10926109729188427102,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,8213334926283197631,15806172446714741507,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16359611139617293316,1011024011042085614,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16359611139617293316,1011024011042085614,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2726160180688118100,11763467549021038288,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10164958874339830436,10624974913972728514,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6116,i,18157582819039966991,8084428086023208221,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,2905284685895599877,7677017112047384394,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,16376991830259483496,2796504494216989754,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,18298070270161095561,3945497828730142432,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,3436411709140748746,10054593555240495697,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3734315503670318549,531527166038842271,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6020,i,2335555514751841448,5120458162285170146,2097152 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,5336180598303584933,13699111052867406591,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,15758775473933600289,10165910019461349592,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,787998630632679504,551346005295552453,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,13512922910540741853,6895752193667944605,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,15256780922966762248,7904647758269339217,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,488919031073817456,3904795229595715317,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,12714967437443270922,12159504890536130996,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5372,i,6052489239497107015,5693858132707239202,262144 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,15839644933881713445,7739722686150016885,524288 --field-trial-handle=2092,i,6931065904053860208,12106331733335861350,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:83⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
protocols.json
nav_config.json
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
1f1e4d99-3122-4168-9548-70411a575159.tmp
2f31c253-3c07-4f23-8cf2-3d5edea894ac.tmp
571b2ce3-ad4c-4e87-b86c-1f43652dcd87.tmp
80d26396-02e0-4ff6-b10a-6b8bcd4425aa.tmp
84a02cfe-ad2c-4daf-99cb-af55d841f621.tmp
1b65900b-ea8a-4d62-bf70-85b3c4285a06.tmp
manifest.json
settings.dat
settings.dat
3e4dd7e5-3176-4945-8cbd-f87c3e367220.tmp
3fdd22cc-db46-4811-b489-ab9ba81454dd.tmp
6efb7494-3e4c-4eb4-9ca9-770f03125f59.tmp
LOG.old
f_000068
96f9b4f9adf74a24_0
df36dda3fc61f9c6_0
temp-index
the-real-index
7fff1034-1cd0-4a0c-b63d-b8e0cebd3961.tmp
dasherSettingSchema.json
25018437-05d8-48d1-aa5e-7557dca0ae3b.tmp
34ef55ed-69eb-43bd-82c4-1ef0a9288429.tmp
c6aeb47b-2bea-4ce8-b001-1d2f50cb6eca.tmp
sync_diagnostic.log
ce17246e-8397-4bd7-a755-121c8173738b.tmp
ce461880-c3e6-4ab4-9e5a-f0b604eea146.tmp
d615a306-37e5-4f76-b9b9-1a9b2fb3d018.tmp
OperationConfig
ef2dfab6-c14a-420c-8787-ccf64519bfb5.tmp
manifest.json
manifest.json
a825d85c-42bb-4c7e-8674-aefc2c95f492.tmp
ba624581-4293-479c-97ba-6954a24eff47.tmp
6a7884a4-c94a-4591-a4e0-d4fba2c3fb29.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
sed_api_weather_info[1].htm
1[1].png
time[1].js
78072150-9e97-4ca6-9f39-e0a20e46b2de.tmp
bzjjkh.exe
e4ba3aa7-7b0e-44f7-b767-8a066c188ef7.tmp
ldsajdklsajdlkjsalkda.bat
messages.json
269c6db2-5406-49b3-a019-9d348bbe4679.tmp
content.js
014677.exe
075996.exe
120178.exe
449550.exe
491440.exe
602011.exe
729890.exe
747522.exe
824052.exe
858294.exe
862503.exe
875054.exe
memory/4396-1338-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4396-356-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4396-1602-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5100-168-0x0000000000400000-0x000000000059A000-memory.dmp