Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 10:50
General
- Target 2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261020-mxff2agw91
- SHA256 cd42b628fa5ee9f8158f29a50db55641acba8f91e09921cc0f6363be84a140d1
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 39 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_adc44710047c742eb1ba1b637caa8b98_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hvfecy.exe"C:\Users\Admin\AppData\Local\Temp\hvfecy.exe" /jscxyxztjkl2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hvfecy.exe"C:\Users\Admin\AppData\Local\Temp\hvfecy.exe" /jsjczxztcq3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\146373.exe"C:\Users\Admin\AppData\Roaming\Download\146373.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\146373.exe"C:\Users\Admin\AppData\Roaming\Download\146373.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\406424.exe"C:\Users\Admin\AppData\Roaming\Download\406424.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\406424.exe"C:\Users\Admin\AppData\Roaming\Download\406424.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\132213.exe"C:\Users\Admin\AppData\Roaming\Download\132213.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\132213.exe"C:\Users\Admin\AppData\Roaming\Download\132213.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\774762.exe"C:\Users\Admin\AppData\Roaming\Download\774762.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\774762.exe"C:\Users\Admin\AppData\Roaming\Download\774762.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\410461.exe"C:\Users\Admin\AppData\Roaming\Download\410461.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\410461.exe"C:\Users\Admin\AppData\Roaming\Download\410461.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\777479.exe"C:\Users\Admin\AppData\Roaming\Download\777479.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\777479.exe"C:\Users\Admin\AppData\Roaming\Download\777479.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\920537.exe"C:\Users\Admin\AppData\Roaming\Download\920537.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\920537.exe"C:\Users\Admin\AppData\Roaming\Download\920537.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\803066.exe"C:\Users\Admin\AppData\Roaming\Download\803066.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\803066.exe"C:\Users\Admin\AppData\Roaming\Download\803066.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\945144.exe"C:\Users\Admin\AppData\Roaming\Download\945144.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\945144.exe"C:\Users\Admin\AppData\Roaming\Download\945144.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\168410.exe"C:\Users\Admin\AppData\Roaming\Download\168410.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\168410.exe"C:\Users\Admin\AppData\Roaming\Download\168410.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\213392.exe"C:\Users\Admin\AppData\Roaming\Download\213392.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\213392.exe"C:\Users\Admin\AppData\Roaming\Download\213392.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\500380.exe"C:\Users\Admin\AppData\Roaming\Download\500380.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\500380.exe"C:\Users\Admin\AppData\Roaming\Download\500380.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\482631.exe"C:\Users\Admin\AppData\Roaming\Download\482631.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\482631.exe"C:\Users\Admin\AppData\Roaming\Download\482631.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\614997.exe"C:\Users\Admin\AppData\Roaming\Download\614997.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\614997.exe"C:\Users\Admin\AppData\Roaming\Download\614997.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\771328.exe"C:\Users\Admin\AppData\Roaming\Download\771328.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\771328.exe"C:\Users\Admin\AppData\Roaming\Download\771328.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\779953.exe"C:\Users\Admin\AppData\Roaming\Download\779953.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\779953.exe"C:\Users\Admin\AppData\Roaming\Download\779953.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\791019.exe"C:\Users\Admin\AppData\Roaming\Download\791019.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\791019.exe"C:\Users\Admin\AppData\Roaming\Download\791019.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\723375.exe"C:\Users\Admin\AppData\Roaming\Download\723375.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\723375.exe"C:\Users\Admin\AppData\Roaming\Download\723375.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\966432.exe"C:\Users\Admin\AppData\Roaming\Download\966432.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\966432.exe"C:\Users\Admin\AppData\Roaming\Download\966432.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\849883.exe"C:\Users\Admin\AppData\Roaming\Download\849883.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\849883.exe"C:\Users\Admin\AppData\Roaming\Download\849883.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\095864.exe"C:\Users\Admin\AppData\Roaming\Download\095864.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\095864.exe"C:\Users\Admin\AppData\Roaming\Download\095864.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\482862.exe"C:\Users\Admin\AppData\Roaming\Download\482862.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\482862.exe"C:\Users\Admin\AppData\Roaming\Download\482862.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\504929.exe"C:\Users\Admin\AppData\Roaming\Download\504929.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\504929.exe"C:\Users\Admin\AppData\Roaming\Download\504929.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\405478.exe"C:\Users\Admin\AppData\Roaming\Download\405478.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\405478.exe"C:\Users\Admin\AppData\Roaming\Download\405478.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\673268.exe"C:\Users\Admin\AppData\Roaming\Download\673268.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\673268.exe"C:\Users\Admin\AppData\Roaming\Download\673268.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\815554.exe"C:\Users\Admin\AppData\Roaming\Download\815554.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\815554.exe"C:\Users\Admin\AppData\Roaming\Download\815554.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\806775.exe"C:\Users\Admin\AppData\Roaming\Download\806775.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\806775.exe"C:\Users\Admin\AppData\Roaming\Download\806775.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\840061.exe"C:\Users\Admin\AppData\Roaming\Download\840061.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\840061.exe"C:\Users\Admin\AppData\Roaming\Download\840061.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\921592.exe"C:\Users\Admin\AppData\Roaming\Download\921592.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\921592.exe"C:\Users\Admin\AppData\Roaming\Download\921592.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\095482.exe"C:\Users\Admin\AppData\Roaming\Download\095482.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\095482.exe"C:\Users\Admin\AppData\Roaming\Download\095482.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\138748.exe"C:\Users\Admin\AppData\Roaming\Download\138748.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\138748.exe"C:\Users\Admin\AppData\Roaming\Download\138748.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\219099.exe"C:\Users\Admin\AppData\Roaming\Download\219099.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\219099.exe"C:\Users\Admin\AppData\Roaming\Download\219099.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\406097.exe"C:\Users\Admin\AppData\Roaming\Download\406097.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\406097.exe"C:\Users\Admin\AppData\Roaming\Download\406097.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\510134.exe"C:\Users\Admin\AppData\Roaming\Download\510134.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\510134.exe"C:\Users\Admin\AppData\Roaming\Download\510134.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\081859.exe"C:\Users\Admin\AppData\Roaming\Download\081859.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\081859.exe"C:\Users\Admin\AppData\Roaming\Download\081859.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\133135.exe"C:\Users\Admin\AppData\Roaming\Download\133135.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\133135.exe"C:\Users\Admin\AppData\Roaming\Download\133135.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\903569.exe"C:\Users\Admin\AppData\Roaming\Download\903569.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\903569.exe"C:\Users\Admin\AppData\Roaming\Download\903569.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\202373.exe"C:\Users\Admin\AppData\Roaming\Download\202373.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\202373.exe"C:\Users\Admin\AppData\Roaming\Download\202373.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\271707.exe"C:\Users\Admin\AppData\Roaming\Download\271707.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\271707.exe"C:\Users\Admin\AppData\Roaming\Download\271707.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\672421.exe"C:\Users\Admin\AppData\Roaming\Download\672421.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\672421.exe"C:\Users\Admin\AppData\Roaming\Download\672421.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\614787.exe"C:\Users\Admin\AppData\Roaming\Download\614787.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\614787.exe"C:\Users\Admin\AppData\Roaming\Download\614787.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\692312.exe"C:\Users\Admin\AppData\Roaming\Download\692312.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\692312.exe"C:\Users\Admin\AppData\Roaming\Download\692312.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\472946.exe"C:\Users\Admin\AppData\Roaming\Download\472946.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\472946.exe"C:\Users\Admin\AppData\Roaming\Download\472946.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\494002.exe"C:\Users\Admin\AppData\Roaming\Download\494002.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\494002.exe"C:\Users\Admin\AppData\Roaming\Download\494002.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\636368.exe"C:\Users\Admin\AppData\Roaming\Download\636368.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\636368.exe"C:\Users\Admin\AppData\Roaming\Download\636368.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\138899.exe"C:\Users\Admin\AppData\Roaming\Download\138899.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\138899.exe"C:\Users\Admin\AppData\Roaming\Download\138899.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\529513.exe"C:\Users\Admin\AppData\Roaming\Download\529513.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\529513.exe"C:\Users\Admin\AppData\Roaming\Download\529513.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ffc7c46c188,0x7ffc7c46c194,0x7ffc7c46c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,14453714143544227217,690140799556405780,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11432459407001579817,2050293045076950962,262144 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,4199400937571749713,14082436215624112981,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8768158646302832641,2557882990273502159,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3922939528628073644,12149927165022188602,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,15535333456600685871,9614685021577100548,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5259945009094843173,3452636153000669491,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9785782168518981172,16523972668009109775,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,5197729338234495039,2160453944972875784,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,14142298947125106607,6066221427067454327,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10569582941779624618,3749449275811196405,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14123263605674540560,3015522512923796174,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14123263605674540560,3015522512923796174,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5708138011205752338,2230308707347842427,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12646560081285002802,5441522268386903417,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6296,i,10799724881610576596,7559543572776526470,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,16695134563133661897,7695714493873788515,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12770510046985955424,9389796974143814303,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,11338474423619879162,5946600593390900374,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,5873861950416784621,5756748590105596138,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,13444553856242016410,16689756603933895650,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6428,i,16133987593075425860,18374058976608740994,2097152 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12348239624275463667,9540756594531814021,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,11686244454515211478,16417720740910109761,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,11460292757419951013,3724046391682569184,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,12905991389842666161,326347328479232402,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,7740493268251802908,14500996910000279633,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3567698782111803351,15274950850477909506,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=856 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,11228514269987329485,12589115504406591153,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4552,i,15173241823287583573,14151626960462540368,262144 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,4669599470311661401,12925909970993133643,524288 --field-trial-handle=2220,i,16693487154078599434,5292632478366441410,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:83⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
nav_config.json
protocols.json
4b4437a5-e956-43e1-8027-2e70b6c5e1a4.tmp
623044c0-03be-4f36-99e5-31394fb53fb9.tmp
manifest.json
settings.dat
34d8e484-b2cd-4f87-aec1-0148e6db4708.tmp
3ad4e9d2-06cf-45cf-aae1-3c11e6ef2cbb.tmp
765fda9f-ce66-420d-b8eb-434926a807cb.tmp
f_000062
the-real-index
cffe513b-a17b-4eba-a12f-6736b86f3763.tmp
dasherSettingSchema.json
01ca5f63-06f4-4c74-b6ee-bbb06c8c74b5.tmp
888d26f8-8f28-479d-8367-7106ac1f26ef.tmp
d9a95b09-ce71-466b-baca-878df2a55a47.tmp
fce341d6-fe90-42ac-95ae-ad23bf5b8519.tmp
sync_diagnostic.log
a81cd437-390c-4105-a26b-80f8071e4e7e.tmp
e9af2131-189e-4dfb-8739-2f86cd32cb0c.tmp
f720d5b7-c5a2-485a-8615-1cd4a68f621b.tmp
496e1164-4efd-4c6c-b359-e36149d27a7e.tmp
OperationConfig
manifest.json
manifest.json
manifest.json
bedf26e5-061f-4701-8e0f-7cae06639e4c.tmp
17c89964-16f4-4309-bb30-4196f24deb24.tmp
3dfb4a98-3ce1-4484-9b95-fef4e8b57ac0.tmp
f37cb34c-82e9-4ea0-8292-11a3f84d4878.tmp
d985990a-26ef-4207-af01-bdf27d1d3996.tmp
7a3972ad-b3bb-474c-9db3-ef046804c4d0.tmp
fa888058-cb99-4c23-87ec-b1514a5e3fca.tmp
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
sed_api_weather_info[1].htm
time[1].js
0[1].png
30effddb-6ed3-4b10-95da-5c8fd66a0187.tmp
4cd21200-c8a0-43f2-bae4-63b8a33c7f62.tmp
hvfecy.exe
ldsajdklsajdlkjsalkda.bat
messages.json
2e848733-771c-4197-975f-09d3c81aeeb8.tmp
verified_contents.json
content.js
manifest.json
132213.exe
146373.exe
168410.exe
213392.exe
406424.exe
410461.exe
500380.exe
774762.exe
777479.exe
803066.exe
920537.exe
945144.exe
memory/1664-147-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1732-141-0x000000000EEC0000-0x000000000EFC0000-memory.dmp
memory/3820-1463-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1525-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1233-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1571-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1407-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1660-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1356-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-457-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1198-0x0000000000400000-0x000000000059A000-memory.dmp
memory/3820-1291-0x0000000000400000-0x000000000059A000-memory.dmp