Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 08:46
General
- Target 2026-10-22_733571d4dcb10e093138637e43176f39_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261024-kpp96agy6x
- SHA256 89b715601409331b23c8f4182d91996404c0ba96804308f3f80f6ea26053cf29
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 52 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 30 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_733571d4dcb10e093138637e43176f39_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_733571d4dcb10e093138637e43176f39_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vrhmsp.exe"C:\Users\Admin\AppData\Local\Temp\vrhmsp.exe" /jscxyxztjkl2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vrhmsp.exe"C:\Users\Admin\AppData\Local\Temp\vrhmsp.exe" /jsjczxztcq3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\908793.exe"C:\Users\Admin\AppData\Roaming\Download\908793.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\908793.exe"C:\Users\Admin\AppData\Roaming\Download\908793.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\778670.exe"C:\Users\Admin\AppData\Roaming\Download\778670.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\778670.exe"C:\Users\Admin\AppData\Roaming\Download\778670.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\037459.exe"C:\Users\Admin\AppData\Roaming\Download\037459.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\037459.exe"C:\Users\Admin\AppData\Roaming\Download\037459.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\607163.exe"C:\Users\Admin\AppData\Roaming\Download\607163.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\607163.exe"C:\Users\Admin\AppData\Roaming\Download\607163.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\753346.exe"C:\Users\Admin\AppData\Roaming\Download\753346.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\753346.exe"C:\Users\Admin\AppData\Roaming\Download\753346.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\795402.exe"C:\Users\Admin\AppData\Roaming\Download\795402.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\795402.exe"C:\Users\Admin\AppData\Roaming\Download\795402.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\121584.exe"C:\Users\Admin\AppData\Roaming\Download\121584.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\121584.exe"C:\Users\Admin\AppData\Roaming\Download\121584.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\422206.exe"C:\Users\Admin\AppData\Roaming\Download\422206.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\422206.exe"C:\Users\Admin\AppData\Roaming\Download\422206.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\564364.exe"C:\Users\Admin\AppData\Roaming\Download\564364.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\564364.exe"C:\Users\Admin\AppData\Roaming\Download\564364.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\787620.exe"C:\Users\Admin\AppData\Roaming\Download\787620.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\787620.exe"C:\Users\Admin\AppData\Roaming\Download\787620.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\709786.exe"C:\Users\Admin\AppData\Roaming\Download\709786.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\709786.exe"C:\Users\Admin\AppData\Roaming\Download\709786.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\610137.exe"C:\Users\Admin\AppData\Roaming\Download\610137.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\610137.exe"C:\Users\Admin\AppData\Roaming\Download\610137.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\635493.exe"C:\Users\Admin\AppData\Roaming\Download\635493.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\635493.exe"C:\Users\Admin\AppData\Roaming\Download\635493.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\977569.exe"C:\Users\Admin\AppData\Roaming\Download\977569.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\977569.exe"C:\Users\Admin\AppData\Roaming\Download\977569.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\909825.exe"C:\Users\Admin\AppData\Roaming\Download\909825.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\909825.exe"C:\Users\Admin\AppData\Roaming\Download\909825.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\942901.exe"C:\Users\Admin\AppData\Roaming\Download\942901.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\942901.exe"C:\Users\Admin\AppData\Roaming\Download\942901.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\378163.exe"C:\Users\Admin\AppData\Roaming\Download\378163.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\378163.exe"C:\Users\Admin\AppData\Roaming\Download\378163.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\165517.exe"C:\Users\Admin\AppData\Roaming\Download\165517.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\165517.exe"C:\Users\Admin\AppData\Roaming\Download\165517.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\291770.exe"C:\Users\Admin\AppData\Roaming\Download\291770.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\291770.exe"C:\Users\Admin\AppData\Roaming\Download\291770.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\446866.exe"C:\Users\Admin\AppData\Roaming\Download\446866.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\446866.exe"C:\Users\Admin\AppData\Roaming\Download\446866.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\468122.exe"C:\Users\Admin\AppData\Roaming\Download\468122.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\468122.exe"C:\Users\Admin\AppData\Roaming\Download\468122.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\500380.exe"C:\Users\Admin\AppData\Roaming\Download\500380.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\500380.exe"C:\Users\Admin\AppData\Roaming\Download\500380.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\388714.exe"C:\Users\Admin\AppData\Roaming\Download\388714.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\388714.exe"C:\Users\Admin\AppData\Roaming\Download\388714.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\461265.exe"C:\Users\Admin\AppData\Roaming\Download\461265.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\461265.exe"C:\Users\Admin\AppData\Roaming\Download\461265.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\436687.exe"C:\Users\Admin\AppData\Roaming\Download\436687.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\436687.exe"C:\Users\Admin\AppData\Roaming\Download\436687.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\923484.exe"C:\Users\Admin\AppData\Roaming\Download\923484.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\923484.exe"C:\Users\Admin\AppData\Roaming\Download\923484.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\049667.exe"C:\Users\Admin\AppData\Roaming\Download\049667.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\049667.exe"C:\Users\Admin\AppData\Roaming\Download\049667.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\092723.exe"C:\Users\Admin\AppData\Roaming\Download\092723.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\092723.exe"C:\Users\Admin\AppData\Roaming\Download\092723.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\314089.exe"C:\Users\Admin\AppData\Roaming\Download\314089.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\314089.exe"C:\Users\Admin\AppData\Roaming\Download\314089.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\112523.exe"C:\Users\Admin\AppData\Roaming\Download\112523.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\112523.exe"C:\Users\Admin\AppData\Roaming\Download\112523.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\482237.exe"C:\Users\Admin\AppData\Roaming\Download\482237.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\482237.exe"C:\Users\Admin\AppData\Roaming\Download\482237.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\340046.exe"C:\Users\Admin\AppData\Roaming\Download\340046.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\340046.exe"C:\Users\Admin\AppData\Roaming\Download\340046.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\618844.exe"C:\Users\Admin\AppData\Roaming\Download\618844.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\618844.exe"C:\Users\Admin\AppData\Roaming\Download\618844.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\405478.exe"C:\Users\Admin\AppData\Roaming\Download\405478.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\405478.exe"C:\Users\Admin\AppData\Roaming\Download\405478.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\673268.exe"C:\Users\Admin\AppData\Roaming\Download\673268.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\673268.exe"C:\Users\Admin\AppData\Roaming\Download\673268.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\987533.exe"C:\Users\Admin\AppData\Roaming\Download\987533.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\987533.exe"C:\Users\Admin\AppData\Roaming\Download\987533.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\520870.exe"C:\Users\Admin\AppData\Roaming\Download\520870.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\520870.exe"C:\Users\Admin\AppData\Roaming\Download\520870.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\715898.exe"C:\Users\Admin\AppData\Roaming\Download\715898.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\715898.exe"C:\Users\Admin\AppData\Roaming\Download\715898.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\041759.exe"C:\Users\Admin\AppData\Roaming\Download\041759.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\041759.exe"C:\Users\Admin\AppData\Roaming\Download\041759.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\185037.exe"C:\Users\Admin\AppData\Roaming\Download\185037.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\185037.exe"C:\Users\Admin\AppData\Roaming\Download\185037.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\108192.exe"C:\Users\Admin\AppData\Roaming\Download\108192.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\108192.exe"C:\Users\Admin\AppData\Roaming\Download\108192.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\185727.exe"C:\Users\Admin\AppData\Roaming\Download\185727.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\185727.exe"C:\Users\Admin\AppData\Roaming\Download\185727.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\128083.exe"C:\Users\Admin\AppData\Roaming\Download\128083.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\128083.exe"C:\Users\Admin\AppData\Roaming\Download\128083.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\908417.exe"C:\Users\Admin\AppData\Roaming\Download\908417.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\908417.exe"C:\Users\Admin\AppData\Roaming\Download\908417.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\120783.exe"C:\Users\Admin\AppData\Roaming\Download\120783.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\120783.exe"C:\Users\Admin\AppData\Roaming\Download\120783.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\489582.exe"C:\Users\Admin\AppData\Roaming\Download\489582.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\489582.exe"C:\Users\Admin\AppData\Roaming\Download\489582.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\666370.exe"C:\Users\Admin\AppData\Roaming\Download\666370.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\666370.exe"C:\Users\Admin\AppData\Roaming\Download\666370.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\065284.exe"C:\Users\Admin\AppData\Roaming\Download\065284.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\065284.exe"C:\Users\Admin\AppData\Roaming\Download\065284.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffacbfcc188,0x7ffacbfcc194,0x7ffacbfcc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4518912108067499853,8285167380643768236,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16494568162899700081,14668795960396382627,262144 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,12414653546661710254,961429941462193655,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,7208966853406251746,16353481167490052225,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,2214727432658947597,12684095018262711089,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1001323027421345096,7950596885012413684,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,8105719894610375577,943215075111760332,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2777001052224506820,15527796083397491615,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,14751239720858326024,17227079391406018866,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5084,i,10853485358994613368,2736061249042076435,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8329989772328112504,7971286982072538212,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13293851367703960087,12653056066125376523,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10503775522970880801,17530504453195897033,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14014480009165086101,5895985006353930942,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,2189513433794397065,7831250851399218082,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,2189513433794397065,7831250851399218082,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10973132036949823385,11480729222439038277,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13545279229914535885,764004824938317743,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,17968328589715426118,4205715665945106031,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,13763002289899875967,8338297132031843403,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4273924441836184144,14083752918472300578,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6868,i,3694851242893284978,7882550616365484858,2097152 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,9787363704144499245,13903408897727526584,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,3165265886937400647,11759283838247457339,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,134527372183042500,13414564510441813577,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,13457934985070398956,18081077939283943708,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,16058029383935613174,3685828204202379636,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,7964307246900676828,8500501712853244818,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,5808462079123407728,3390270281501767837,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4596,i,18307505944784177737,9660883765635696877,262144 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,242405733907354063,12189193789262584640,524288 --field-trial-handle=2216,i,1970303450007749272,17647955192045604541,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:83⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
protocols.json
nav_config.json
34441a2c-62e7-47bc-8f29-679e229ecd7e.tmp
46953a7b-d860-44c7-b327-283acdda26f1.tmp
8f8e8748-1a0e-42fa-9c45-4ab81fbb9c40.tmp
9aef60dc-28b6-4bde-b3af-a48983aeae0c.tmp
manifest.json
settings.dat
1aebbd9f-cd75-4eb1-859e-1fa2f804766e.tmp
6ada56e6-8f38-4a21-8a01-ebca0e33ce3b.tmp
6ae3b3ef-378c-4684-a785-7028ae451cd4.tmp
6e135559-db05-46c8-a1ab-4663d88cc45d.tmp
759acd11-f165-4738-86bb-80ef8bbb0dd9.tmp
86e9b8bd-b3e0-4757-ab02-4dd1534c3013.tmp
f_00004d
f_000056
temp-index
82bd2d27-cf94-46c9-8f11-a14a1ea2025b.tmp
dasherSettingSchema.json
5223944a-13c6-4e01-9e2d-95f2f03bcfb9.tmp
6302e3bc-f34b-43cf-b8d4-346c464d12dc.tmp
ba423788-7a75-4a6d-afd1-3a9f36b7874f.tmp
sync_diagnostic.log
1a81b824-c009-4392-ac66-aec9d1865dc3.tmp
OperationConfig
manifest.json
manifest.json
manifest.json
2aa8333d-c558-4e55-a25e-93951cfbfebc.tmp
89b3915f-fafc-47a3-98e8-5aef10a705da.tmp
a5932657-2d36-4446-ac76-919ee0ffff70.tmp
e425e458-1bca-4fb5-a23f-b44d2d1609a0.tmp
038771ba-d655-4b98-8bf5-8d692c599d3d.tmp
hao.360[1].xml
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
7[1].png
2[1].png
time[1].js
sed_api_weather_info[1].htm
aeba0277-b1bb-400f-b00c-96aaf102ae51.tmp
c1b37909-12ee-4e7b-a1d7-2dbeecfff408.tmp
ldsajdklsajdlkjsalkda.bat
messages.json
9b9246d5-24db-4ede-92ea-b7f3cec2ce88.tmp
content.js
vrhmsp.exe
037459.exe
121584.exe
422206.exe
564364.exe
607163.exe
610137.exe
709786.exe
753346.exe
778670.exe
787620.exe
795402.exe
908793.exe
memory/1104-285-0x0000000000400000-0x000000000059A000-memory.dmp
memory/1800-130-0x000000000BCD0000-0x000000000BDD0000-memory.dmp
memory/2416-424-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1458-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1515-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1415-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1570-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1308-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1150-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1359-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-898-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2416-1624-0x0000000000400000-0x000000000059A000-memory.dmp