Bladabindi and Redline on two of them. Those were also configured by someone to disable alerts and scheduled scans in Defender. On the third it was something to do with bitcoin / wallet stealing and I don't use bitcoin. I can't remember the name. I just boot them up long enough to know it isn't DOA then eventually wipe them with Linux assuming I even keep the tiny NVME they come with. I started running scans after seeing the mini-PC malware issues in 2023 to let others on Amazon know what I find and to steer very clear of those vendors.