fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Size 994KB
Sample260802-j2364swsdw
SHA256 fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32
MD5 208b71fb9476380662524b5ffb503f3a
SHA1 bb4eb8350cfe9d23411ba523eb9a257434006331
SHA512 df1981d160f18c93108186b30c76d0d9e4bc2cae16de58cd43b7ea5b63df33a447b2c112e760540e49410933f3d94039b7e9c93dc57baa237d6a492d6a1fc5e9
SSDEEP 24576:j2zoA37n+kicRE2oR0vX7j/RG28Xz1bR4P5qR:jdA37n+kcaRG28FuPM
TLSH
T123257C5AA6E001EAC567C279CD664603EB76F41A13707BDB0BD686961F23BE09F3D301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 54 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rps.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsmain.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360huabao.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360huabao.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360TotalSec.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safemon.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Trash.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Doctor.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Doctor.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DesktopLite64.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileSync.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zhudongfangyu.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DeepScan.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DeepScan.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360LeakFixer.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DumpUper.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rps.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360BrowseProc.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SafeMain.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360ts.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DumpUper.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360TotalSec.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftMgrLite.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftMgrLite.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsmain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepScan.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safemon.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Trash.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DesktopLite64.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360LeakFixer.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepScan.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360RP.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360RP.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360BrowseProc.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SafeMain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360ts.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileSync.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\ca.crt.pem	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3760	sc.exe
5416	sc.exe
3564	sc.exe
920	sc.exe
4492	sc.exe
1096	sc.exe
2880	sc.exe
3536	sc.exe
3740	sc.exe
5408	sc.exe
4252	sc.exe
2716	sc.exe
5016	sc.exe
4268	sc.exe
3044	sc.exe
3360	sc.exe
3360	sc.exe
3740	sc.exe
3360	sc.exe
52	sc.exe
2512	sc.exe
1204	sc.exe
1504	sc.exe
4312	sc.exe
5912	sc.exe
4584	sc.exe
2644	sc.exe
5732	sc.exe
2984	sc.exe
4276	sc.exe
5016	sc.exe
4860	sc.exe
4388	sc.exe
988	sc.exe
2648	sc.exe
5996	sc.exe
2668	sc.exe
3504	sc.exe
2232	sc.exe
1364	sc.exe
4696	sc.exe
1492	sc.exe
4596	sc.exe
2376	sc.exe
3108	sc.exe
2948	sc.exe
5660	sc.exe
1284	sc.exe
4876	sc.exe
2736	sc.exe
3984	sc.exe
6072	sc.exe
5772	sc.exe
708	sc.exe
1896	sc.exe
5452	sc.exe
6012	sc.exe
948	sc.exe
244	sc.exe
5496	sc.exe
1348	sc.exe
5968	sc.exe
240	sc.exe
5220	sc.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=74"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=0"	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeLoadDriverPrivilege	4296	fltmc.exe
Token: SeLoadDriverPrivilege	1856	fltmc.exe
Token: SeLoadDriverPrivilege	2972	fltmc.exe
Token: SeLoadDriverPrivilege	4072	fltmc.exe
Token: SeLoadDriverPrivilege	3580	fltmc.exe
Token: SeLoadDriverPrivilege	1500	fltmc.exe
Token: SeLoadDriverPrivilege	2408	fltmc.exe
Token: SeLoadDriverPrivilege	4080	fltmc.exe
Token: SeLoadDriverPrivilege	4996	fltmc.exe
Token: SeLoadDriverPrivilege	3840	fltmc.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeLoadDriverPrivilege	1384	fltmc.exe
Token: SeLoadDriverPrivilege	556	fltmc.exe
Token: SeLoadDriverPrivilege	1928	fltmc.exe
Token: SeLoadDriverPrivilege	1204	fltmc.exe
Token: SeLoadDriverPrivilege	2096	fltmc.exe
Token: SeLoadDriverPrivilege	4664	fltmc.exe
Token: SeLoadDriverPrivilege	1048	fltmc.exe
Token: SeLoadDriverPrivilege	3688	fltmc.exe
Token: SeLoadDriverPrivilege	5988	fltmc.exe
Token: SeLoadDriverPrivilege	4868	fltmc.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
Token: SeDebugPrivilege	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4296	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	88
PID 4248 wrote to memory of 1856	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	90
PID 4248 wrote to memory of 2972	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	92
PID 4248 wrote to memory of 4072	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	94
PID 4248 wrote to memory of 3580	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	96
PID 4248 wrote to memory of 1500	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	98
PID 4248 wrote to memory of 2408	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	100
PID 4248 wrote to memory of 4080	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	102
PID 4248 wrote to memory of 4996	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	104
PID 4248 wrote to memory of 3840	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	106
PID 4248 wrote to memory of 2976	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	108
PID 4248 wrote to memory of 4252	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	110
PID 4248 wrote to memory of 5756	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	112
PID 4248 wrote to memory of 5732	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	114
PID 4248 wrote to memory of 3564	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	116
PID 4248 wrote to memory of 2176	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	118
PID 4248 wrote to memory of 3972	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	120
PID 4248 wrote to memory of 2784	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	122
PID 4248 wrote to memory of 6092	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	124
PID 4248 wrote to memory of 4520	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	126
PID 4248 wrote to memory of 4344	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	128
PID 4248 wrote to memory of 2644	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	130
PID 4248 wrote to memory of 5672	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	132
PID 4248 wrote to memory of 3984	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	134
PID 4248 wrote to memory of 2616	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	136
PID 4248 wrote to memory of 2648	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	138
PID 4248 wrote to memory of 3344	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	140
PID 4248 wrote to memory of 2800	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	142
PID 4248 wrote to memory of 1600	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	144
PID 4248 wrote to memory of 1380	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	146
PID 4248 wrote to memory of 6016	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	148
PID 4248 wrote to memory of 556	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	150
PID 4248 wrote to memory of 5792	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	152
PID 4248 wrote to memory of 1204	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	154
PID 4248 wrote to memory of 6072	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	156
PID 4248 wrote to memory of 4460	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	158
PID 4248 wrote to memory of 4264	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	160
PID 4248 wrote to memory of 5912	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	162
PID 4248 wrote to memory of 4040	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	164
PID 4248 wrote to memory of 3296	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	166
PID 4248 wrote to memory of 5728	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	168
PID 4248 wrote to memory of 5016	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	170
PID 4248 wrote to memory of 4412	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	172
PID 4248 wrote to memory of 3360	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	174
PID 4248 wrote to memory of 5500	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	176
PID 4248 wrote to memory of 2296	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	178
PID 4248 wrote to memory of 4792	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	180
PID 4248 wrote to memory of 5780	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	182
PID 4248 wrote to memory of 4240	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	184
PID 4248 wrote to memory of 4548	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	186
PID 4248 wrote to memory of 4872	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	188
PID 4248 wrote to memory of 5476	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	190
PID 4248 wrote to memory of 3308	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	192
PID 4248 wrote to memory of 52	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	194
PID 4248 wrote to memory of 3020	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	196
PID 4248 wrote to memory of 4120	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	198
PID 4248 wrote to memory of 2948	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	200
PID 4248 wrote to memory of 5660	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	202
PID 4248 wrote to memory of 1464	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	204
PID 4248 wrote to memory of 4216	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	206
PID 4248 wrote to memory of 820	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	208
PID 4248 wrote to memory of 1284	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	210
PID 4248 wrote to memory of 4388	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	212
PID 4248 wrote to memory of 3104	4248	fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe	214

C:\Users\Admin\AppData\Local\Temp\fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe
"C:\Users\Admin\AppData\Local\Temp\fe8919a1c0778a2e173322c6dfb78d9367b598780a1d22785402a9b571af9e32.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4072
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:2976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:4252
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:5756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  PID:5732
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:3564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:2176
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:3972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:2784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:6092
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:4520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:4344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:2644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  PID:5672
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:3984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:2616
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  - Launches sc.exe
  PID:2648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:3344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:2800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  PID:1600
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:1380
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  PID:6016
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:556
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:5792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  - Launches sc.exe
  PID:1204
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:6072
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:4460
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:4264
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  - Launches sc.exe
  PID:5912
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:3296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  PID:5728
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:4412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  PID:5500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:2296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  PID:4792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:5780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  PID:4240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:4548
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:4872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:5476
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:3308
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:52
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:3020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  - Launches sc.exe
  PID:2948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  - Launches sc.exe
  PID:5660
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:1464
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:4216
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  - Launches sc.exe
  PID:1284
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Safe
  2⤵
  PID:4388
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Safe start= disabled
  2⤵
  PID:3104
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:4876
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:1760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:5800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:1872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  - Launches sc.exe
  PID:1364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:612
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:5880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:2088
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  PID:2724
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:2516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:4220
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:2536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:5996
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:5976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:5496
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:3536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:4688
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:3096
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:4640
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:4156
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:2736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:5536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  PID:4852
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:2108
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:2596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:1268
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:2576
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  - Launches sc.exe
  PID:2880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:3448
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  PID:4660
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:4996
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:2624
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:2976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:4876
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:3472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:3288
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:1872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:3668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  - Launches sc.exe
  PID:5772
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  - Launches sc.exe
  PID:2716
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:2164
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:920
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:1556
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:4584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:2112
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  PID:5656
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:4168
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:2968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:3928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:4708
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:2084
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:5848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:1928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:1204
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:1076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:4664
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:4828
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:3688
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:5812
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Safe
  2⤵
  PID:1092
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Safe start= disabled
  2⤵
  - Launches sc.exe
  PID:1348
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:5996
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:3504
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:3360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:5496
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  - Launches sc.exe
  PID:3536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:4688
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:4900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  PID:4440
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:2768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:2736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:3308
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:3736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  PID:3972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:4860
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  PID:4520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  - Launches sc.exe
  PID:2644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:6116
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:1036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:2180
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:2616
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:1192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:4696
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:1924
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:1380
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  - Launches sc.exe
  PID:1504
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:556
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:5916
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  PID:500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:6128
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:1048
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:1340
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:1376
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  PID:4368
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  - Launches sc.exe
  PID:1492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:5296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:2208
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:1632
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  PID:4792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:2656
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:4780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:4900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  PID:4440
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  - Launches sc.exe
  PID:708
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  PID:5568
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  - Launches sc.exe
  PID:1896
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  PID:3172
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:2972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:5576
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:6088
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:924
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:1464
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:5368
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:5336
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:4288
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:1284
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:1796
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:3968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:2624
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:4768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Safe
  2⤵
  PID:3152
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Safe start= disabled
  2⤵
  PID:3260
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:1872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:3004
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:1708
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:2784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  PID:3304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:5668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:2500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:4596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  - Launches sc.exe
  PID:5452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:5644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:2648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:6036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  PID:5500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:3504
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  PID:4804
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:4508
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:2780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:4872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:2000
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:5624
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:3908
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  - Launches sc.exe
  PID:52
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:1268
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:1080
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:2576
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  - Launches sc.exe
  PID:4312
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:2792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  PID:5320
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:4124
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:4388
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:5472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:2148
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:2976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:5732
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  - Launches sc.exe
  PID:4268
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:936
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  - Launches sc.exe
  PID:2984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:3668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:5772
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:3304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:2384
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:5424
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  PID:4596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:5452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  PID:4584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:5644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  PID:1664
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:1112
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:1252
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  - Launches sc.exe
  PID:6012
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  - Launches sc.exe
  PID:2232
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  - Launches sc.exe
  PID:5968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:1240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:3832
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:1260
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:4060
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:1748
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:1980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:2584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:1108
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Safe
  2⤵
  PID:3424
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Safe start= disabled
  2⤵
  PID:120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:4756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:4760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:5912
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  - Launches sc.exe
  PID:240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:5340
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:3712
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  PID:1092
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:5976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  PID:3884
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:5276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:4792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  PID:4188
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:3104
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  PID:3340
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:5800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:3288
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  - Launches sc.exe
  PID:5220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:5824
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:2064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  - Launches sc.exe
  PID:4492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:3760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:1544
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:2500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:4596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  - Launches sc.exe
  PID:3984
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:5316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:2648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:988
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  - Launches sc.exe
  PID:244
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:5028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:5548
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  PID:5968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:3364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:1120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:1316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  - Launches sc.exe
  PID:5408
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:4604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  PID:932
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:480
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:3756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:3348
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:5416
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:1200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  PID:4756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:2252
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  PID:1028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:5988
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:1376
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:4588
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:3396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:1212
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  - Launches sc.exe
  PID:2376
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:3704
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:1180
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:5792
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:1744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:4544
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:460
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:2768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Safe
  2⤵
  PID:5536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Safe start= disabled
  2⤵
  PID:4472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:1064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:1916
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:3192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:1564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  - Launches sc.exe
  PID:3108
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:616
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  PID:3416
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  - Launches sc.exe
  PID:1096
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  PID:3268
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:2952
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ca.crt.pem

Path C:\ProgramData\YngRuntime\backup\ca.crt.pem
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem

Path C:\ProgramData\YngRuntime\backup\ca.key.pem
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 33B
SHA256 75ca6c11e577081f69a73688c60159e68a281752025bf6da3d4205a378fbbbcd
MD5 5a25e27b2b6f77433cc7aae0a7da28b4
SHA1 68e519f0da241be40bbd1a4a8da916f002d8ecbb
SHA512 8f48d33c7936177e1a5dec7a6059f1e626bdefa4f4c8f91e39dd47f1fd2db8c2fc4ccb341b66c12998fa7f113ecd08b838fee4b2bac2bd64cd49f31878543a7d
MD5 SHA1 SHA512

Submit Download

host7-sync.log

Path C:\ProgramData\YngRuntime\host7-sync.log
Size 5KB
SHA256 50e2e2d4c362f27c2d585df431ac747501ff74fd87af45bcd03ab1319e2bca03
MD5 12c0a358685422b9455915202ab8ceaf
SHA1 5afde2f04cc385fb9c55617e655a405345cef2ec
SHA512 28e388722e622ab12463ec22ddebb8c865b6c8480cc42c845c3b4299cecc6585acd5ccb4a687a00c41232cc39f6443d2ed3287978a5fc99c90667a892b97dedc
SSDEEP 48:KihkH9x0Y9iYbA5nVuCehoBY0WF22nbgBOHBm/u65B5nVuCehoBY0WF22nbgBOHX:KihkH9xX9fbOr/9n9Hc
TLSH
T1A3C15C24CE7D64D11CA3108DF9EA29DF99BBFC5874786998F3B489152ACD884DF40C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host7-sync.log

Path C:\ProgramData\YngRuntime\host7-sync.log
Size 2KB
SHA256 0091af2a5a63a2ca7c37301905cb37356695b2f006e365faca88ef8e83d16710
MD5 233eb6507a328c8f615b1b871c2d4037
SHA1 e99404879934cc5a39854f6fe020d50fc17d6405
SHA512 d1a1d801ab199049ee1ef46a299b7f5f46c34c6a43cd7ee1a92334c443a92a6d50095da5190b5eb8e7e20454035ec928df20712bb8eb176997172d9af162aca9
TLSH
T1904191248EBD60D21CA7004DF9EA39DF99BBFC18747C6958F770891916CD884EF40C4A
MD5 SHA1 SHA512 TLSH

Submit Download

host7-sync.log

Path C:\ProgramData\YngRuntime\host7-sync.log
Size 3KB
SHA256 601665206bda81f622ec833518074754c78cd01dd5f052c133cf480bdb26c7d6
MD5 a1e0bb53064e5ba0f3252abe72a79182
SHA1 7dc52b338609e454b388b887e86fda928789cd3a
SHA512 f02b526a735d4cfa9bd9abc325277d335e0bed010ca23acc63bd4ea428085c4ddbe98b12ed774e833cd4725c666fb8bd9db2d3cedd96f8e0ab6cf0c476b574e9
TLSH
T163616D248EBD64C21CA3104DF9EA39DF99BBFC18747C6998F37089191ACD884DF40C4A
MD5 SHA1 SHA512 TLSH

Submit Download

host7-sync.log

Path C:\ProgramData\YngRuntime\host7-sync.log
Size 3KB
SHA256 cf3fe0939dddde77f4d878a91e833b8aae5fef14b3876ebeefdb0464939b561b
MD5 b0dece7faef43719f4b1b3ba787af2cd
SHA1 05e2bc38a132f1496ffd4d8d0fef7b8e00b9b18a
SHA512 667442d2d19d75e534b449499c2029779b46474cab749128bb00d66089f6ad8e1338cf62e8555b3c3652368aca89a5591fad5b028da69eb5f60119ae220ac7ad
TLSH
T138715C248E7D54D21CA3108DF9E639DF99BBFC1874786998F770851916CD884DF40C4A
MD5 SHA1 SHA512 TLSH

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download